Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

DefenderXDR Advanced Hunting All-In-One UPN Search

Steven Lim@KQLWizard

•updated Jul 1, 2025•8•0•81

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1071 - Application Layer Protocol T1059 - Command and Scripting Interpreter T1055 - Process Injection T1070 - Indicator Removal T1083 - File and Directory Discovery T1021 - Remote Services T1114 - Email Collection T1041 - Exfiltration Over C2 Channel T1486 - Data Encrypted for Impact TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control TA0002 - Execution TA0007 - Discovery TA0008 - Lateral Movement TA0009 - Collection TA0010 - Exfiltration TA0040 - Impact Credential Access Logon Event File Event Process Event Network Connection Email Sent Email Received Cloud Api Call Windows Office 365 Azure Windows Defender Atp M365 Unified Audit Log Azure Signin Logs Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?