Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detect Power Pwn (aka LOLCopilot) Red Team Tool

Steven Lim@KQLWizard

•updated Jul 1, 2025•4•0•73

KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1105 - Ingress Tool Transfer T1078 - Valid Accounts T1202 - Indirect Command Execution TA0011 - Command and Control TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access DS0031 - Cluster T1543.005 - Container Service T1218.015 - Electron Applications T1176.001 - Browser Extensions T1185 - Browser Session Hijacking T1217 - Browser Information Discovery T1566 - Phishing T1598 - Phishing for Information T1566.002 - Spearphishing Link TA0010 - Exfiltration T1567.004 - Exfiltration Over Webhook TA0009 - Collection TA0007 - Discovery TA0043 - Reconnaissance Network Connection Authentication Attempt Command Execution Script Execution HTTP Request Credential Access Data Exfiltration Windows Azure Office 365 Windows Defender Atp Azure Signin Logs Azure Sentinel M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?