Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

NEW Microsoft Graph API Identity Protection KQL Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•4•0•102

KQL Query

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1078 - Valid Accounts T1087.004 - Cloud Account T1070.004 - File Deletion T1020 - Automated Exfiltration TA0011 - Command and Control TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery TA0010 - Exfiltration T1567 - Exfiltration Over Web Service T1119 - Automated Collection T1530 - Data from Cloud Storage T1526 - Cloud Service Discovery TA0009 - Collection Cloud Api Call Authentication Attempt Data Exfiltration Azure Saas Application Azure Signin Logs M365 Unified Audit Log Azure Ad Risk Detectionkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?