Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Microsoft Defender Advanced Hunting Copilot Activities

Steven Lim@KQLWizard

•updated Jul 1, 2025•11•0•163

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1059 - Command and Scripting Interpreter T1550 - Use Alternate Authentication Material T1083 - File and Directory Discovery T1114 - Email Collection T1071 - Application Layer Protocol T1041 - Exfiltration Over C2 Channel TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0002 - Execution TA0008 - Lateral Movement TA0007 - Discovery TA0009 - Collection TA0011 - Command and Control TA0010 - Exfiltration T1566 - Phishing T1598 - Phishing for Information T1566.002 - Spearphishing Link TA0043 - Reconnaissance Application Event Authentication Success Authentication Failure Credential Access Data Exfiltration Network Connection Cloud Api Call Azure Office 365 Saas Application Azure Signin Logs Azure Ad Risk Detection M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?