Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detect API Spray Attack on your Entra High Value Assets

Steven Lim@KQLWizard

•updated Jul 1, 2025•10•0•114

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.004 - Cloud Accounts T1190 - Exploit Public-Facing Application T1087 - Account Discovery T1485 - Data Destruction TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery TA0040 - Impact T1106 - Native API T1059.009 - Cloud API T1552.007 - Container API G0126 - Higaisa S0126 - ComRAT S0581 - IronNetInjector S0173 - FLIPSIDE S0053 - SeaDuke G0053 - FIN5 TA0002 - Execution TA0006 - Credential Access Authentication Failure Credential Access Cloud Api Call Azure AWS Azure Signin Logs Azure Sentinel AWS Cloudtrailkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?