• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Tracking Password Changes

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•2•0•50

    'This script identifies password changes or resets across multiple host and cloud sources. Account manipulation, including password changes and resets, may help adversaries maintain access to credentials and permission levels.'

    Microsoft Sentinel (KQL)

    Tags

    T1078 - Valid AccountsT1110 - Brute ForceTA0001 - Initial AccessTA0006 - Credential AccessT1098 - Account ManipulationTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationUser Account ModifiedCredential AccessWindowsAzureOffice 365LinuxWindows Eventlog SecurityAzure Activity LogsM365 Unified Audit LogSyslog Generic ForwarderAzure Signin Logskqltactic:InitialAccesstactic:CredentialAccesstechnique:T1078technique:T1110

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?