Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

NotOnboarded Devices by DeviceName Suffix

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•0•16

This query searches for not onboarded devices with a specific Suffix

Microsoft Sentinel (KQL)

Tags

TA0005 - Defense Evasion TA0007 - Discovery T1574.011 - Services Registry Permissions Weakness TA0003 - Persistence TA0004 - Privilege Escalation T1098.005 - Device Registration T1059.008 - Network Device CLI T1652 - Device Driver Discovery T1120 - Peripheral Device Discovery T1526 - Cloud Service Discovery T1003.008 - /etc/passwd and /etc/shadow C0045 - ShadowRay S0596 - ShadowPad T1211 - Exploitation for Defense Evasion T1622 - Debugger Evasion T1019 - System Firmware T1569 - System Services T1501 - Systemd Service S0687 - Cyclops Blink T1564.013 - Bind Mounts TA0002 - Execution TA0006 - Credential Access System Monitoring Status Windows Microsoft Exchange Server Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?