Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Azure cloud account takeover (ATO) Reconnaissance Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•116

KQL Query

Microsoft Sentinel (KQL)

Tags

T1087.004 - Cloud Account T1078.004 - Cloud Accounts T1071.001 - Web Protocols TA0007 - Discovery TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control enterprise-attack - Enterprise ATT&CK S0684 - ROADTools T1526 - Cloud Service Discovery T1102 - Web Service T1021.007 - Cloud Services TA0043 - Reconnaissance S0233 - MURKYTOP S1075 - KOPILUWAK T1098 - Account Manipulation T1136 - Create Account DS0002 - User Account TA0008 - Lateral Movement Cloud Api Call Authentication Attempt Command Execution Azure Office 365 Azure Signin Logs Azure Monitor Logs M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?