Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Azure Resource Graph Explorer - KQL Change Analysis

Steven Lim@KQLWizard

•updated Jul 1, 2025•4•0•50

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1098 - Account Manipulation T1003 - OS Credential Dumping T1071 - Application Layer Protocol T1566 - Phishing TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access TA0011 - Command and Control T1526 - Cloud Service Discovery T1564.009 - Resource Forking TA0042 - Resource Development G0119 - Indrik Spider T1102 - Web Service enterprise-attack - Enterprise ATT&CK S0684 - ROADTools T1505.001 - SQL Stored Procedures S0225 - sqlmap TA0007 - Discovery Admin Activity Cloud Api Call Authentication Attempt Azure Azure Activity Logs Azure Monitor Logskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?