Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

DefenderXDR Advanced Hunting All-In-One IP Search

Steven Lim@KQLWizard

•updated Jul 1, 2025•9•0•87

KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1078 - Valid Accounts T1040 - Network Sniffing T1105 - Ingress Tool Transfer T1566.001 - Spearphishing Attachment T1071.004 - DNS T1087.001 - Local Account T1136.001 - Local Account TA0011 - Command and Control TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access TA0007 - Discovery T1599.001 - Network Address Translation Traversal T1557.002 - ARP Cache Poisoning T1568.003 - DNS Calculation T1021 - Remote Services M1029 - Remote Data Storage TA0009 - Collection TA0008 - Lateral Movement Network Connection Authentication Attempt File Event Email Received DNS Query Logon Event Windows Azure Office 365 Windows Defender Atp M365 Unified Audit Log Azure Signin Logs Azure Activity Logskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?