Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Cobalt Strike HTTPS beaconing over Microsoft Graph API

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•90

KQL Query

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1078 - Valid Accounts T1078.003 - Local Accounts TA0011 - Command and Control TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access S0154 - Cobalt Strike G0080 - Cobalt Group G0041 - Strider S0586 - TAINTEDSCRIBE T1063 - Security Software Discovery T1518.001 - Security Software Discovery T1106 - Native API T1059.009 - Cloud API T1552.007 - Container API TA0007 - Discovery TA0002 - Execution TA0006 - Credential Access Network Connection Outbound Command Execution HTTP Request Windows Azure Windows Defender Atp M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?