• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Multiple Password Reset by user

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•6•0•98

    'This query will determine multiple password resets by user across multiple data sources. Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.'

    Microsoft Sentinel (KQL)

    Tags

    T1078 - Valid AccountsT1110 - Brute ForceTA0001 - Initial AccessTA0006 - Credential AccessTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationT1098 - Account ManipulationAuthentication AttemptUser Account ModifiedCredential AccessWindowsAzureOffice 365LinuxWindows Eventlog SecurityAzure Activity LogsM365 Unified Audit LogSyslog Generic Forwarderkqltactic:InitialAccesstactic:CredentialAccesstechnique:T1078technique:T1110

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?