Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

KQL Sniper for Compromised Account (Sentinel UEBA)

Steven Lim@KQLWizard

•updated Jul 1, 2025•9•0•154

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1071 - Application Layer Protocol T1087 - Account Discovery T1057 - Process Discovery T1589 - Gather Victim Identity Information TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control TA0007 - Discovery TA0043 - Reconnaissance T1586 - Compromise Accounts M1056 - Pre-compromise T1586.003 - Cloud Accounts T1556.007 - Hybrid Identity T1098.005 - Device Registration T1055.011 - Extra Window Memory Injection M1019 - Threat Intelligence Program T1588.007 - Artificial Intelligence TA0042 - Resource Development TA0006 - Credential Access Authentication Success Authentication Failure Credential Access Logon Event Admin Activity Azure Azure Sentinel Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?