Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Monitoring restricted management administrative units abuse

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•108

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.002 - Domain Accounts T1098 - Account Manipulation T1098.001 - Additional Cloud Credentials T1548 - Abuse Elevation Control Mechanism T1548.002 - Bypass User Account Control TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access T1651 - Cloud Administration Command TA0002 - Execution Admin Activity Cloud Api Call Policy Change Authentication Success Azure Office 365 Azure Activity Logs Azure Sentinel M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?