Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Entra Cross-Tenant Activity Monitoring

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•126

KQL Query from file: Entra Cross-Tenant Activity Monitoring

Microsoft Sentinel (KQL)

Tags

T1484 - Domain or Tenant Policy Modification T1484.002 - Trust Modification T1484.001 - Group Policy Modification M1056 - Pre-compromise T1586 - Compromise Accounts S0099 - Arp T1527 - Application Access Token T1528 - Steal Application Access Token T1550.001 - Application Access Token TA0005 - Defense Evasion TA0004 - Privilege Escalation TA0042 - Resource Development TA0008 - Lateral Movement TA0006 - Credential Access Authentication Success Authentication Attempt Cloud Api Call Azure Saas Application Azure Signin Logs M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?