Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Exposure Management: Cloud or On-Prem VDI Platform Blast Radius

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•0•39

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.001 - Default Accounts T1078.002 - Domain Accounts T1078.003 - Local Accounts T1087 - Account Discovery T1087.001 - Local Account T1087.002 - Domain Account T1087.003 - Email Account T1210 - Exploitation of Remote Services T1069 - Permission Groups Discovery TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery TA0008 - Lateral Movement T1595.002 - Vulnerability Scanning TA0043 - Reconnaissance Vulnerability Scan Detected Credential Access Exploit Attempt Logon Event Windows Azure Windows Defender Atp Azure Sentinelkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?