Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detect Microsoft Graph API Abuse

Steven Lim@KQLWizard

•updated Jul 1, 2025•13•0•173

KQL Query from file: Detect Microsoft Graph API Abuse

Microsoft Sentinel (KQL)

Tags

T1078 - Valid Accounts T1071 - Application Layer Protocol T1070 - Indicator Removal T1059 - Command and Scripting Interpreter TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control TA0002 - Execution T1654 - Log Enumeration DS0026 - Active Directory M1015 - Active Directory Configuration TA0043 - Reconnaissance S0233 - MURKYTOP S1075 - KOPILUWAK T1592 - Gather Victim Host Information T1595 - Active Scanning T1590 - Gather Victim Network Information T1526 - Cloud Service Discovery T1538 - Cloud Infrastructure Discovery TA0007 - Discovery Cloud Api Call Authentication Attempt Authentication Success Authentication Failure Credential Access Admin Activity Azure Office 365 Azure Signin Logs Azure Ad Risk Detection M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?