Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Tracking The Most Dangerous Entra Admin Role

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•0•66

KQL Query from file: Tracking The Most Dangerous Entra Admin Role

Microsoft Sentinel (KQL)

Tags

T1078.004 - Cloud Accounts T1078 - Valid Accounts T1078.001 - Default Accounts TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access T1547.005 - Security Support Provider T1101 - Security Support Provider TA0042 - Resource Development G0018 - admin@338 T1077 - Windows Admin Shares T1591.004 - Identify Roles TA0008 - Lateral Movement TA0043 - Reconnaissance Admin Activity Logon Event Authentication Success Azure Azure Signin Logs Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?