Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

NEW Real-time Anomalous Token Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•131

KQL Query from file: NEW Real-time Anomalous Token Detection

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1071 - Application Layer Protocol T1556 - Modify Authentication Process T1110 - Brute Force TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control TA0006 - Credential Access T1134.001 - Token Impersonation/Theft T1527 - Application Access Token T1134 - Access Token Manipulation DS0026 - Active Directory M1015 - Active Directory Configuration S0684 - ROADTools TA0008 - Lateral Movement Authentication Success Authentication Failure Credential Access Logon Event EDR Alert Azure Saas Application Azure Activity Logs Azure Signin Logs Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?