Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Sentinel All-In-One UPN ThreatHunt

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•76

KQL Query from file: Sentinel All-In-One UPN ThreatHunt

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1059 - Command and Scripting Interpreter T1071 - Application Layer Protocol T1106 - Native API T1110 - Brute Force T1040 - Network Sniffing T1087 - Account Discovery TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0002 - Execution TA0011 - Command and Control TA0006 - Credential Access TA0007 - Discovery DS0038 - Domain Name DS0002 - User Account M1017 - User Training Authentication Attempt Logon Event Cloud Api Call Email Sent Email Received File Access Process Access Azure Office 365 Windows Azure Sentinel M365 Unified Audit Log Windows Eventlog Securitykql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?