Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Threat Intelligence Data from Sentinel UEBA

Steven Lim@KQLWizard

•updated Jul 1, 2025•7•1•121

KQL Query from file: Threat Intelligence Data from Sentinel UEBA

Microsoft Sentinel (KQL)

Tags

T1592 - Gather Victim Host Information T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter T1098 - Account Manipulation T1070 - Indicator Removal T1005 - Data from Local System T1041 - Exfiltration Over C2 Channel TA0043 - Reconnaissance TA0001 - Initial Access TA0002 - Execution TA0003 - Persistence TA0004 - Privilege Escalation TA0005 - Defense Evasion TA0009 - Collection TA0010 - Exfiltration Antivirus Detection Malware Detected EDR Alert SIEM Alert Vulnerability Scan Detected Data Exfiltration Authentication Attempt Credential Access Azure Azure Sentinel Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?