• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Unfamiliar Signin Correlation with AzurePortal Signin Attempts and AuditLogs

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•1•0•44

    'This query looks for unfamiliar Sign-in's thats not seen recently for the given user with azure portal login attempts and audit logs to help detect and reduce the analysis timeline for defenders'

    Microsoft Sentinel (KQL)

    Tags

    T1190 - Exploit Public-Facing ApplicationT1078 - Valid AccountsTA0001 - Initial AccessTA0040 - ImpactTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationT1110 - Brute ForceT1098.003 - Additional Cloud RolesTA0006 - Credential AccessAuthentication FailureAuthentication AttemptCredential AccessUser Group AssignmentAdmin ActivityAzureAzure Signin LogsAzure Activity LogsAzure SentinelAzure Ad Risk Detectionkqltactic:InitialAccesstactic:Impacttechnique:T1190technique:T1078

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?