Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

EchoSpoofing

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•0•38

KQL Query from file: EchoSpoofing

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1071.003 - Mail Protocols T1589.002 - Email Addresses T1078.003 - Local Accounts TA0011 - Command and Control TA0043 - Reconnaissance TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access T1566 - Phishing T1598 - Phishing for Information T1566.002 - Spearphishing Link T1193 - Spearphishing Attachment T1566.001 - Spearphishing Attachment T1598.002 - Spearphishing Attachment T1114 - Email Collection T1114.002 - Remote Email Collection T1114.001 - Local Email Collection T1078 - Valid Accounts TA0009 - Collection Email Received Email Phishing Detected Office 365 M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?