Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Monitor Azure API Secrets Extraction

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•97

KQL Query from file: Monitor Azure API Secrets Extraction

Microsoft Sentinel (KQL)

Tags

T1070.004 - File Deletion T1552.001 - Credentials In Files T1078 - Valid Accounts T1087.001 - Local Account TA0005 - Defense Evasion TA0006 - Credential Access TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery T1106 - Native API T1059.009 - Cloud API T1552.007 - Container API T1003.004 - LSA Secrets T1555.006 - Cloud Secrets Management Stores S0008 - gsecdump TA0002 - Execution Cloud Api Call Credential Access Admin Activity Azure Azure Activity Logskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?