Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Attacker in the Middle Precision Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•128

KQL Query from file: Attacker in the Middle Precision Detection

Microsoft Sentinel (KQL)

Tags

T1550.004 - Web Session Cookie T1071.001 - Web Protocols T1078 - Valid Accounts T1556.004 - Network Device Authentication T1557.002 - ARP Cache Poisoning TA0005 - Defense Evasion TA0008 - Lateral Movement TA0011 - Command and Control TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0006 - Credential Access TA0009 - Collection T1134.001 - Token Impersonation/Theft T1527 - Application Access Token T1134 - Access Token Manipulation T1185 - Browser Session Hijacking T1563 - Remote Service Session Hijacking T1563.002 - RDP Hijacking T1557 - Adversary-in-the-Middle Authentication Success Authentication Failure Credential Access Logon Event Network Connection Azure Azure Ad Risk Detection Azure Sentinelkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?