Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Measuring Sentinel WatchList Effectiveness using Behaviour Analytics

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•66

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078.004 - Cloud Accounts T1110 - Brute Force T1595 - Active Scanning TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access TA0043 - Reconnaissance enterprise-attack - Enterprise ATT&CK T1556.007 - Hybrid Identity T1526 - Cloud Service Discovery TA0007 - Discovery Authentication Failure Credential Access Cloud Api Call Azure Azure Sentinel Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?