Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

GraphRunner Recon Detection & Response

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•1•354

KQL Query from file: GraphRunner Recon Detection & Response

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1078.004 - Cloud Accounts T1078.001 - Default Accounts T1556 - Modify Authentication Process TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access T1526 - Cloud Service Discovery T1102 - Web Service T1021.007 - Cloud Services T1572 - Protocol Tunneling T1547.002 - Authentication Package T1131 - Authentication Package TA0043 - Reconnaissance TA0007 - Discovery TA0011 - Command and Control TA0008 - Lateral Movement Authentication Success Authentication Failure Credential Access Logon Event Azure Office 365 Azure Signin Logs Azure Sentinelkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?