July 10, 202620 min read

KQL Detection Query Library for Microsoft Sentinel: 50 High-Fidelity Queries Mapped to MITRE ATT&CK

Sources:MITRE ATT&CK Enterprise Framework v15|Microsoft Sentinel Analytics Rules documentation|Microsoft Sentinel GitHub Community Detection Rules|KQL Quick Reference

Eric Bang

Founder & Cybersecurity Evangelist

detection queries in this library, organized by MITRE ATT&CK tactic across Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Lateral Movement, and Exfiltration

KQL

Kusto Query Language: Microsoft Sentinel's native detection language, also used in Azure Data Explorer, Azure Monitor, and Microsoft Defender products

80%

of detection rules in this library require only three log source tables: SecurityEvent (Windows), SigninLogs (Entra ID), and AuditLogs (M365/Entra ID changes)

MITRE v15

queries are mapped to MITRE ATT&CK Enterprise Framework version 15, the current release as of 2026

How to Use This Library

Each query in this library is structured for direct use as a Microsoft Sentinel Scheduled Query Rule. To deploy a query as an analytics rule: navigate to Sentinel > Analytics > Create > Scheduled query rule, paste the query into the Rule query field, set the frequency and lookback window as specified in the entry, and configure entity mapping for any IP address, account, or host entities referenced in the query results.

Before enabling any rule in enforcement mode (where it creates incidents), run it against 30 days of historical data using the Log Analytics query editor to validate expected results and identify false positive patterns. Rules with high false positive rates should be deployed in observation mode (alert rule with low-severity, no automatic incident creation) for tuning before promotion to incident-generating rules.

Three log source tables are required for the majority of this library's queries: SecurityEvent (Windows Security event log forwarded via Azure Monitoring Agent or Log Analytics Agent), SigninLogs (Entra ID sign-in telemetry, enabled in Entra ID Diagnostic Settings), and AuditLogs (Entra ID and Microsoft 365 change events). Enable these three tables first and you will have the data required for approximately 80 percent of the queries in this library.

Initial Access Detections

Initial Access techniques represent how adversaries gain a foothold. The highest-value detections target credential-based attacks against cloud identity and phishing indicators in email telemetry.

Password spray detection (T1110.003)

Detects a single source IP authenticating against many accounts with low per-account failure counts -- the signature pattern of password spray. `Required: SigninLogs` // `SigninLogs | where ResultType != 0 | summarize FailedAccounts = dcount(UserPrincipalName), FailureCount = count() by IPAddress, bin(TimeGenerated, 1h) | where FailedAccounts > 20 and FailureCount < FailedAccounts * 3` // Tune: exclude known vulnerability scanners, load balancer health check IPs, and service account source IPs that legitimately authenticate against multiple accounts.

Impossible travel sign-in (T1078)

Detects successful sign-ins from geographically distant locations within a time window shorter than travel allows. `Required: SigninLogs` // `SigninLogs | where ResultType == 0 | extend Country = tostring(LocationDetails.countryOrRegion) | summarize Locations = make_set(Country), SignInCount = count() by UserPrincipalName, bin(TimeGenerated, 4h) | where array_length(Locations) > 1` // Tune: apply a travel time threshold -- calculate distance between location pairs and filter for only those where flight time exceeds the time window between sign-ins.

New country sign-in for privileged account (T1078.004)

Detects when a Global Administrator or Privileged Role Administrator signs in from a country not in their recent 30-day sign-in history. `Required: SigninLogs` // Build a 30-day baseline of countries per admin account using `summarize HistoricalCountries = make_set(tostring(LocationDetails.countryOrRegion)) by UserPrincipalName`, then join against current sign-ins and flag where the new country is not in the historical set. Tune: exclude travel announced in HR systems or helpdesk tickets.

Unfamiliar sign-in properties (T1078)

Detects sign-ins flagged by Entra ID Identity Protection's risk detection engine as having unfamiliar properties -- new device, new browser agent, new ASN. `Required: SigninLogs` // `SigninLogs | where RiskEventTypes_V2 has_any ('unfamiliarFeatures', 'unknownFutureValue') | where ResultType == 0` // This query surfaces successful sign-ins that Entra ID flagged as risky but did not block -- high-fidelity when filtered to privileged accounts.

OAuth app granted high-privilege permissions (T1550.001)

Detects OAuth app consent grants that include high-privilege Microsoft Graph API permissions (Mail.ReadWrite, Files.ReadWrite.All, Directory.ReadWrite.All). `Required: AuditLogs` // `AuditLogs | where OperationName == 'Consent to application' | extend Permissions = tostring(TargetResources[0].modifiedProperties) | where Permissions has_any ('Mail.ReadWrite', 'Files.ReadWrite.All', 'Directory.ReadWrite.All') | project TimeGenerated, InitiatedBy, AppDisplayName, Permissions`

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

Execution and Persistence Detections

Execution detections focus on process creation anomalies visible in Windows Security event telemetry. Persistence detections target scheduled tasks, registry run keys, and account creation events.

PowerShell encoded command execution (T1059.001)

Detects PowerShell launched with the EncodedCommand parameter, commonly used to obscure malicious scripts. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4688 | where CommandLine has '-EncodedCommand' or CommandLine has '-enc ' | where ParentProcessName !in ('C:\\Windows\\System32\\svchost.exe', 'C:\\Windows\\System32\\services.exe')` // Tune: exclude known automation tools (Ansible, DSC), patch management agents, and vendor-signed software that legitimately use encoded commands.

Office application spawning cmd or PowerShell (T1566.001)

Detects command shells spawned from Microsoft Office processes -- the signature of macro-based phishing execution. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4688 | where NewProcessName has_any ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe') | where ParentProcessName has_any ('winword.exe', 'excel.exe', 'outlook.exe', 'powerpnt.exe')` // Very low false positive rate -- legitimate Office-to-shell execution is extremely rare in modern environments.

New scheduled task creation by non-system account (T1053.005)

Detects scheduled task creation events where the creating account is not a system or service account. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4698 | where SubjectUserName !endswith '$' | where SubjectUserName !in ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE')` // Tune: build an allow-list of legitimate administrative accounts that create scheduled tasks as part of approved workflows (patch management, backup agents).

Registry run key modification (T1547.001)

Detects writes to common autorun registry locations used for persistence. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4657 | where ObjectName has_any ('HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run', 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run')` // Tune: this event is high-volume; filter to specific high-risk write operations (adding new values) and exclude known software installer process names.

New local administrator account created (T1136.001)

Detects creation of a new local user account that is subsequently added to the local Administrators group -- a common persistence mechanism following privilege escalation. `Required: SecurityEvent` // Correlate EventID 4720 (user account created) with EventID 4732 (user added to security-enabled local group) where the group name is 'Administrators', within a 5-minute window, on the same host.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Privilege Escalation Detections

Privilege escalation detections focus on token manipulation, role assignments in cloud identity, and the use of built-in tools to gain elevated access.

Entra ID privileged role assigned outside PIM (T1078.004)

Detects direct privileged role assignments in Entra ID that bypass Privileged Identity Management (PIM) just-in-time activation -- indicating a misconfiguration or an attacker with Directory.Write permissions. `Required: AuditLogs` // `AuditLogs | where OperationName == 'Add member to role' | where tostring(InitiatedBy.user.userPrincipalName) != '' | extend RoleName = tostring(TargetResources[0].displayName) | where RoleName in ('Global Administrator', 'Privileged Role Administrator', 'Security Administrator')`

PsExec usage for lateral movement or privilege escalation (T1021.002)

Detects PsExec execution using Windows event signatures: the PsExec service creation (Event 7045) and the specific named pipe it creates (EventID 5145 with ShareName 'IPC$' and RelativeTargetName 'PSEXESVC'). `Required: SecurityEvent` // `SecurityEvent | where EventID == 7045 | where ServiceName == 'PSEXESVC'` // This is a high-fidelity detection -- legitimate PsExec in production is uncommon and should be documented in advance.

LSASS memory access attempt (T1003.001)

Detects process access to LSASS memory, the primary indicator of credential dumping via Mimikatz or similar tools. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4656 | where ObjectName endswith 'lsass.exe' | where AccessMask in ('0x1010', '0x1410', '0x143A', '0x40', '0x1FFFFF')` // Tune carefully: EDR products and AV solutions legitimately access LSASS for monitoring; filter by process name, code signing status, and access mask combination.

Azure RBAC privileged role assignment (T1078.004)

Detects Owner or User Access Administrator role assignments on Azure subscriptions or resource groups, which grant the assignee full control over all resources. `Required: AzureActivity` // `AzureActivity | where OperationNameValue == 'Microsoft.Authorization/roleAssignments/write' | extend RoleDefinitionId = tostring(Properties.requestbody) | where RoleDefinitionId has_any ('8e3af657-a8ff-443c-a75c-2fe8c4bcb635', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')` // The GUIDs represent Owner and User Access Administrator roles respectively.

Token impersonation via Entra ID refresh token reuse (T1550.001)

Detects refresh token reuse from a different IP address than the original authentication -- a signature of stolen token replay. `Required: SigninLogs` // Join the initial token issuance SigninLog entry (AuthenticationMethodsUsed has 'refreshToken') against subsequent sign-in events for the same user and compare IPAddress values. Flag where the IP changes within the same token session without a corresponding interactive authentication event.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Defense Evasion Detections

Defense evasion detections focus on log clearing, diagnostic setting deletion, and the disabling of security controls -- all actions that adversaries take to reduce detection visibility.

Windows Security event log cleared (T1070.001)

Detects clearing of the Windows Security event log, a common attacker action to remove evidence. `Required: SecurityEvent` // `SecurityEvent | where EventID == 1102` // EventID 1102 is generated specifically when the Security audit log is cleared. This is a high-fidelity detection with very few legitimate false positives -- the Security log is rarely cleared intentionally in production environments.

Microsoft Sentinel diagnostic settings deleted (T1562.008)

Detects deletion of Entra ID diagnostic settings that forward sign-in and audit logs to Sentinel -- an attacker attempting to disable logging visibility. `Required: AzureActivity` // `AzureActivity | where OperationNameValue == 'microsoft.insights/diagnosticSettings/delete' | where ResourceProvider == 'Microsoft.Aad'`

Defender for Endpoint tamper protection disabled (T1562.001)

Detects registry changes that indicate Defender for Endpoint tamper protection has been disabled -- typically via a tamper-proof bypass technique or a misconfigured exclusion. `Required: SecurityEvent or DeviceRegistryEvents (Defender for Endpoint)` // In Defender for Endpoint via MDE advanced hunting: `DeviceRegistryEvents | where RegistryKey has 'Windows Defender' | where RegistryValueName == 'DisableAntiSpyware' | where RegistryValueData == '1'`

Obfuscated command via environment variable substitution (T1027)

Detects command-line execution patterns using environment variable substitution to evade simple string-matching detections -- e.g., `%COMSPEC%` instead of `cmd.exe`. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4688 | where CommandLine matches regex @'%[A-Za-z_]+%'| where CommandLine has_any ('powershell', 'cmd', 'wscript', 'cscript')` // Tune to exclude known legitimate scripts that use environment variables for portability.

Azure policy assignment deleted (T1562.008)

Detects deletion of Azure Policy assignments that enforce security controls (e.g., requiring encryption, enforcing allowed SKUs, or requiring diagnostic settings). `Required: AzureActivity` // `AzureActivity | where OperationNameValue == 'Microsoft.Authorization/policyAssignments/delete' | extend PolicyName = tostring(Properties.policyDefinitionId)` // Filter to security-critical policy assignments by matching PolicyName against a Watchlist of your enforced security policies.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Credential Access Detections

Credential access detections cover brute force, Kerberoasting, and credential exposure in cloud storage -- the three most common credential theft patterns observed in Microsoft cloud environments.

Brute force against Entra ID accounts (T1110.001)

Detects repeated failed authentication attempts against a single account from a single source, the signature of targeted brute force (distinct from password spray). `Required: SigninLogs` // `SigninLogs | where ResultType != 0 | summarize FailureCount = count(), UniqueAccounts = dcount(UserPrincipalName) by IPAddress, UserPrincipalName, bin(TimeGenerated, 10m) | where FailureCount > 10 and UniqueAccounts == 1` // Tune threshold per environment; MFA-enabled accounts require different threshold than password-only accounts.

Kerberoasting service ticket request pattern (T1558.003)

Detects bulk Kerberos service ticket requests (EventID 4769 with TicketOptions 0x40810000 and TicketEncryptionType 0x17) -- the signature of Kerberoasting. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4769 | where TicketOptions == '0x40810000' | where TicketEncryptionType == '0x17' | summarize RequestCount = count() by AccountName, bin(TimeGenerated, 5m) | where RequestCount > 5` // RC4 encryption (0x17) for service tickets is a strong Kerberoasting indicator since modern Kerberos uses AES.

Credentials stored in public Azure blob storage (T1552.005)

Detects anonymous read access to Azure blob storage containers -- indicating storage accounts that may contain sensitive data accessible without authentication. `Required: StorageBlobLogs` // `StorageBlobLogs | where AuthenticationType == 'Anonymous' | where StatusCode == 200 | summarize AccessCount = count() by Uri, CallerIpAddress | where AccessCount > 1` // Immediately review any public storage access for credential file names (*.json, *.key, *.pem, .env, credentials.*).

Secret value read from Azure Key Vault (T1552.001)

Detects reading of Key Vault secrets by principals not in the approved access list, or bulk secret reads suggesting credential harvesting. `Required: AzureDiagnostics` // `AzureDiagnostics | where ResourceProvider == 'MICROSOFT.KEYVAULT' | where OperationName == 'SecretGet' | where ResultType == 'Success' | summarize SecretReads = count(), UniqueSecrets = dcount(id_s) by CallerIPAddress, identity_claim_oid_g, bin(TimeGenerated, 1h) | where UniqueSecrets > 5`

SAM database access via reg.exe (T1003.002)

Detects attempts to access the Security Account Manager database using the reg.exe save command -- a credential dumping technique that does not require LSASS process access. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4688 | where CommandLine has 'reg' | where CommandLine has_any ('save', 'export') | where CommandLine has_any ('hklm\\sam', 'hklm\\security', 'hklm\\system')` // Near-zero false positive rate -- this command pattern has no legitimate administrative use case in modern Windows environments.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Lateral Movement Detections

Lateral movement detections focus on Remote Desktop Protocol (RDP) anomalies, pass-the-hash patterns, and service account misuse across Windows event telemetry.

RDP login from unusual source (T1021.001)

Detects RDP authentication events (Event 4624, LogonType 10) from source IPs not in the approved administrative access list. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4624 | where LogonType == 10 | extend SourceIP = tostring(IpAddress) | join kind=leftanti (RDPApprovedSources) on SourceIP | where SourceIP != '' and SourceIP != '-'` // Maintain a Watchlist of approved RDP source IP ranges (jump servers, VPN egress IPs) and use it as the anti-join.

Pass-the-hash detection via NTLMv1 authentication (T1550.002)

Detects NTLM authentication events where the package is NTLMv1 -- a legacy protocol increasingly used in pass-the-hash attacks because NTLMv2 challenge-response is harder to relay. `Required: SecurityEvent` // `SecurityEvent | where EventID == 4624 | where AuthenticationPackageName == 'NTLM' | where LmPackageName == 'NTLM V1'` // Most modern environments do not need NTLMv1; its presence is anomalous and warrants investigation regardless of count.

Unusual service account lateral movement (T1021.002)

Detects network logon events (LogonType 3) by service accounts (accounts ending in Svc or with known service account naming patterns) to systems outside their normal communication scope. `Required: SecurityEvent` // Build a 30-day baseline of destination hosts per service account, then alert when a service account authenticates to a host not in its historical baseline within the same time window.

Azure VM serial console access (T1021)

Detects access to the Azure Virtual Machine serial console -- a management channel that bypasses network controls and can be used for lateral movement within Azure IaaS. `Required: AzureActivity` // `AzureActivity | where OperationNameValue == 'Microsoft.Compute/virtualMachines/retrieveBootDiagnosticsData/action' or OperationNameValue has 'serialConsole'` // Any serial console access should be reviewed; it is rarely used in normal operations.

SMB named pipe connection to non-standard pipe (T1021.002)

Detects SMB connections to named pipes associated with lateral movement tools (Cobalt Strike, Metasploit, Impacket). `Required: SecurityEvent` // `SecurityEvent | where EventID == 5145 | where ShareName == 'IPC$' | where RelativeTargetName in ('MSSE-1220-server', 'postex_ssh', 'postex_ssh_9045', 'PSEXESVC', 'atsvc', 'epmapper') or RelativeTargetName matches regex '^[a-zA-Z0-9]{4,6}$'` // Known C2 framework default pipe names plus short random pipe names (common Cobalt Strike default).

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Exfiltration and Impact Detections

Exfiltration detections target data transfer volume anomalies, email forwarding rule creation, and SharePoint mass download events -- the most common cloud data theft patterns.

Mass download from SharePoint or OneDrive (T1530)

Detects a single user downloading an unusually large number of files from SharePoint or OneDrive within a short window -- a potential data staging or exfiltration indicator. `Required: OfficeActivity` // `OfficeActivity | where RecordType == 'SharePointFileOperation' | where Operation in ('FileDownloaded', 'FileSyncDownloadedFull') | summarize DownloadCount = count(), TotalBytes = sum(todouble(parse_json(tostring(EventData)).FileSize)) by UserId, bin(TimeGenerated, 1h) | where DownloadCount > 100` // Tune threshold per environment; baseline normal download volumes by team or department before setting alerts.

Email forwarding rule created to external address (T1114.003)

Detects creation of Exchange inbox forwarding rules that redirect email to external domains -- a data exfiltration technique that persists past credential rotation. `Required: OfficeActivity` // `OfficeActivity | where Operation == 'New-InboxRule' | where Parameters has 'ForwardTo' or Parameters has 'RedirectTo' | extend ForwardAddress = extract('ForwardTo.*?([^@]+@[^,"]+)', 1, Parameters) | where ForwardAddress !endswith '@yourdomain.com'` // Replace @yourdomain.com with your organization's primary domain.

Unusual large Azure storage blob upload (T1567.002)

Detects large data uploads to Azure Blob Storage containers, potentially indicating data staging prior to exfiltration. `Required: StorageBlobLogs` // `StorageBlobLogs | where OperationName == 'PutBlob' or OperationName == 'PutBlock' | summarize TotalBytes = sum(ResponseBodySize), UploadCount = count() by CallerIpAddress, Uri, bin(TimeGenerated, 1h) | where TotalBytes > 500000000` // 500 MB threshold -- tune per environment and consider restricting to uploads from non-approved CIDRs.

Conditional access policy deleted (T1562.001)

Detects deletion of Entra ID Conditional Access policies, which could disable authentication enforcement controls (MFA requirements, device compliance gates) for all users in scope. `Required: AuditLogs` // `AuditLogs | where OperationName == 'Delete conditional access policy' | project TimeGenerated, InitiatedBy=tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), PolicyName=tostring(TargetResources[0].displayName)` // High-fidelity: CA policy deletion is a privileged action that should always generate a notification regardless of the identity performing it.

Azure subscription ownership transfer (T1098.001)

Detects transfer of Azure subscription ownership -- which grants full control over all subscription resources to a new account and represents a high-severity identity threat. `Required: AzureActivity` // `AzureActivity | where OperationNameValue == 'Microsoft.Subscription/aliases/write' or OperationNameValue has 'subscription' and OperationNameValue has 'write' | where Caller !in (ApprovedAdminAccounts) | extend SubscriptionId = tostring(parse_json(Properties).subscriptionId)` // Maintain a Watchlist of approved subscription management account identities.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Deploying These Rules in Production

Detection rules are not set-and-forget artifacts. Production deployment requires a quality gate process, a tuning cadence, and an owner for each rule.

Start every rule in observation mode before incident generation

Deploy all rules as Sentinel analytics rules with 'Severity: Informational' and no automation playbook attached. Review the generated alerts manually for 14 to 30 days to identify false positive patterns before promoting to a severity level that pages the SOC. Rules that generate more than 5 false positives per week need further tuning before promotion.

Build entity mappings for every rule

Sentinel's entity mapping configuration links rule query results to entity types (Account, Host, IP, URL, File) that appear in the Sentinel investigation graph. Without entity mapping, alerts are strings; with it, they are connected nodes that Sentinel can link across incidents, UEBA risk scores, and Watchlist entries. Map at least one entity per rule before publishing.

Maintain a rule inventory with MITRE coverage

Track every deployed rule with its MITRE ATT&CK technique mapping, data source dependency, alert volume (weekly average), false positive rate, and owning analyst. MITRE coverage gaps revealed by the inventory become the backlog for new rule development. Sentinel's MITRE ATT&CK coverage view in the Threat Management section shows your coverage visually once rules are tagged.

Review and retune after major environment changes

Active Directory domain consolidations, cloud migrations, new SaaS applications, and VPN infrastructure changes all shift the behavior baseline that detection rules depend on. After any major infrastructure change, review rules that touch affected log sources for false positive spikes and update allow-lists or thresholds before the operational disruption becomes a SOC noise problem.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

A KQL detection library is only as valuable as the process around it. These 50 queries are a starting point -- the production rules for your environment will require tuning against your specific log sources, your organization's behavior baseline, and your threat model priorities. Start with the highest-fidelity rules (password spray, Office-spawning-shell, event log cleared, CA policy deleted) that have near-zero false positive rates before investing time in tuning the behavioral baselines. The Microsoft Sentinel community GitHub repository and the MITRE ATT&CK Detection Coverage project are the best ongoing sources for new detection ideas once this library is fully deployed and tuned.

Sources & references

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

KQL Microsoft Sentinel MITRE ATT&CK detection engineering threat hunting detection rules Sentinel analytics rules KQL queries security operations SOC security detection

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

KQL Detection Query Library for Microsoft Sentinel: 50 High-Fidelity Queries Mapped to MITRE ATT&CK

How to Use This Library

Initial Access Detections

Execution and Persistence Detections

Privilege Escalation Detections

Defense Evasion Detections

Credential Access Detections

Lateral Movement Detections

Exfiltration and Impact Detections

Deploying These Rules in Production

The bottom line

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway