Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Threat Hunting with MDE Device Discovery and SeenBy Enrichment Function

Steven Lim@KQLWizard

•updated Jul 1, 2025•9•0•70

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078.004 - Cloud Accounts T1082 - System Information Discovery T1016 - System Network Configuration Discovery T1021 - Remote Services T1070 - Indicator Removal T1071 - Application Layer Protocol TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery TA0008 - Lateral Movement TA0011 - Command and Control T1120 - Peripheral Device Discovery T1590.005 - IP Addresses T1595.001 - Scanning IP Blocks TA0043 - Reconnaissance Network Connection System Monitoring Status Command Execution Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?