Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Defending malicious MS graph activity with MS Sentinel Threat Intelligence

Steven Lim@KQLWizard

•updated Jul 1, 2025•4•0•122

KQL Query

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1071.003 - Mail Protocols T1595.002 - Vulnerability Scanning T1078 - Valid Accounts T1587.001 - Malware T1589.002 - Email Addresses TA0011 - Command and Control TA0043 - Reconnaissance TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0042 - Resource Development M1019 - Threat Intelligence Program T1588.007 - Artificial Intelligence G0028 - Threat Group-1314 T1106 - Native API DS0029 - Network Traffic T1020.001 - Traffic Duplication T1059.009 - Cloud API TA0002 - Execution TA0010 - Exfiltration Cloud Api Call Network Connection Authentication Attempt Malware Detected Vulnerability Scan Detected Azure Office 365 Azure Sentinel Azure Ad Risk Detection M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?