MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1078Valid Accounts

StealthPersistencePrivilege Escalation

View on MITRE ATT&CK →

2 Queries

Successful Sign-in from Anonymizer or Tor Exit Node

hightestingMicrosoft Sentinel

Microsoft Entra ID·SigninLogs

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| where RiskState == "atRisk" or NetworkLocationDetails has "anonymizer" or IPAddress has_any ("tor", "vpn")
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, RiskLevelDuringSignIn, ConditionalAccessStatus
| sort by TimeGenerated desc

triathIC · last tested 2025-03-01

attack.mitre.org
learn.microsoft.com

Tuning notes

Supplement with a custom watchlist of known Tor exit node IPs for more precise matching. The RiskState field depends on Entra ID P2 licensing.

+ Add another query for this technique →