Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Insider Threat Monitoring - Exfiltrate data via Link to Windows app

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•85

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1069 - Permission Groups Discovery T1105 - Ingress Tool Transfer T1071 - Application Layer Protocol TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery TA0011 - Command and Control TA0010 - Exfiltration T1020 - Automated Exfiltration T1567.004 - Exfiltration Over Webhook T1074 - Data Staged T1041 - Exfiltration Over C2 Channel T1052 - Exfiltration Over Physical Medium T1567 - Exfiltration Over Web Service TA0009 - Collection File Creation Data Exfiltration Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?