Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

KQL to check Privilege Admin failing Microsoft CA MFA enforcement

Steven Lim@KQLWizard

•updated Jul 1, 2025•7•0•75

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.003 - Local Accounts T1110 - Brute Force T1556 - Modify Authentication Process TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access T1556.007 - Hybrid Identity T1556.009 - Conditional Access Policies T1556.006 - Multi-Factor Authentication M1032 - Multi-factor Authentication T1111 - Multi-Factor Authentication Interception Authentication Failure Multifactor Authentication Bypass Admin Activity Azure Office 365 Azure Signin Logs Azure Ad Risk Detection M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?