CloudAppEvents
Search and discover KQL queries for Microsoft Sentinel, Defender, and Azure Monitor
Our Sponsors
EntraIdSignInEvents
Detecting Connections Affected By The Blocking Legacy Authentication Enforcement Expected By July 2025
SecurityEvent
11 DNS Certutil LOL Bin Chain
SecurityEvent
16 DNS DNS Admin DLL Injection
ASimDnsActivityLogs
09 DNS WPAD Abuse
ASimDnsActivityLogs
17 DNS ADIDNS Wildcard Abuse
ASimDnsActivityLogs
08 DNS Data Exfil Long Labels
ThreatIntelIndicatorsASimDnsActivityLogs
19 DNS Threat Intel Domain Match
SecurityEvent
03 DNS Click Fix Nslookup Payload
ASimDnsActivityLogs
04 DNS DGA High Entropy
ASimDnsActivityLogs
06 DNS Amplification Open Resolver
ASimDnsActivityLogs
02 DNS C2 Beaconing Periodic
ASimDnsActivityLogs
10 DNS Internal Recon Sweep
ASimDnsActivityLogs
13 DNS NULL ANY Tunneling
ASimDnsActivityLogs
20 DNS Dynamic DNS Provider Abuse
ASimDnsActivityLogs
12 DNS NXDOMAIN DGA Flood
ASimDnsActivityLogs
07 DNS Rebinding Rapid TTL
ASimDnsActivityLogs
21 DNS Suspicious TLD Volume
ASimDnsActivityLogs
15 DNS Subdomain Enum Brute Force
ASimDnsActivityLogs
01 DNS Tunneling TXT High Volume
ASimDnsActivityLogs
18 DNS Do H Bypass
ASimDnsActivityLogs
14 DNS MX Payload Staging
SigninLogsAADServicePrincipalSignInLogs
HUNT 26 Risky Anonymizer Signin Timeline
AuditLogs
HUNT 24 Guest Invite Privileged Role
AzureActivity
HUNT 09 New SP Key Vault Access
AuditLogs
HUNT 19 Consent Grant Burst
AuditLogs
HUNT 23 MFA Auth Method Changes
AzureActivity
HUNT 25 Storage Data Protection Changes
AzureActivity
HUNT 15 Identity Ops Anomaly Deep Dive
SigninLogs
HUNT 20 Signin Anomalous ASN
AADServicePrincipalSignInLogs
HUNT 18 SP Signin New Country
AzureActivity
HUNT 21 Caller IP Concentration
AzureActivity
HUNT 16 First Seen Resource Provider Per Identity
AzureActivity
HUNT 12 NSG Firewall Change History
AzureActivity
HUNT 17 Key Vault Bulk Read
StorageBlobLogs
HUNT 03 Storage Blob Exfiltration
AuditLogsAzureActivity
HUNT 06 Orphaned Privileged Roles
AzureActivity
HUNT 08 Privileged Ops Outside Hours
AzureActivity
HUNT 14 Sentinel Config Changes
AzureActivity
RULE 09 Privileged Ops New IP
AzureActivity
RULE 03 Mass Privileged Role Assignments
AzureActivity
RULE 17 Anomalous Management Operations
AzureActivity
RULE 15 VM Custom Script Extension
StorageBlobLogs
RULE 13 Storage Anonymous Public Access
AADServicePrincipalSignInLogsAzureActivity
RULE 10 SP CA Bypass Management Ops
AzureActivitySigninLogsAADServicePrincipalSignInLogs
RULE 11 Mass Resource Deletion
AzureActivitySigninLogsAADServicePrincipalSignInLogs
RULE 12 Mass Resource Creation
AuditLogs