Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Sentinel All-In-One IP ThreatHunt

Steven Lim@KQLWizard

•updated Jul 1, 2025•13•2•159

KQL Query from file: Sentinel All-In-One IP ThreatHunt

Microsoft Sentinel (KQL)

Tags

T1566 - Phishing T1189 - Drive-by Compromise T1021 - Remote Services T1070 - Indicator Removal T1046 - Network Service Discovery TA0001 - Initial Access TA0008 - Lateral Movement TA0005 - Defense Evasion TA0007 - Discovery T1599.001 - Network Address Translation Traversal T1557.002 - ARP Cache Poisoning T1568.003 - DNS Calculation M1029 - Remote Data Storage T1219 - Remote Access Tools T1592.004 - Client Configurations T1203 - Exploitation for Client Execution T1557.003 - DHCP Spoofing T1190 - Exploit Public-Facing Application G0018 - admin@338 S0363 - Empire TA0006 - Credential Access TA0009 - Collection TA0011 - Command and Control TA0043 - Reconnaissance TA0002 - Execution Network Connection DNS Query HTTP Request Email Received Email Sent Logon Event File Event Cloud Api Call Windows Azure Office 365 Network Generic Azure Sentinel M365 Unified Audit Log Windows Eventlog Security Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?