Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Add Passkey device-bound MS Authenticator Windows Hello detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•15•0•138

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1556 - Modify Authentication Process T1589 - Gather Victim Identity Information TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access TA0043 - Reconnaissance S0556 - Pay2Key S1010 - VPNFilter T1067 - Bootkit S0343 - Exaramel for Windows T1543.003 - Windows Service S0141 - Winnti for Windows M1029 - Remote Data Storage T1556.007 - Hybrid Identity T1098.005 - Device Registration T1055.011 - Extra Window Memory Injection Authentication Success User Account Modified Azure Windows Azure Activity Logskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?