Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Identity Blast Radius

Steven Lim@KQLWizard

•updated Jul 1, 2025•4•0•42

KQL Query from file: Identity Blast Radius

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1071 - Application Layer Protocol T1087 - Account Discovery TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control TA0007 - Discovery TA0008 - Lateral Movement T1570 - Lateral Tool Transfer S0071 - hcdLoader T1070.009 - Clear Persistence T1128 - Netsh Helper DLL T1094 - Custom Command and Control Protocol DS0017 - Command T1087.002 - Domain Account T1087.001 - Local Account T1078.003 - Local Accounts T1078.004 - Cloud Accounts Authentication Success Authentication Attempt Credential Access Logon Event Admin Activity Azure Azure Signin Logs Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?