MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1136.003Cloud Account

Persistence

View on MITRE ATT&CK →

1 Query

Cloud Account Created — Guest or External User Invited

mediumproductionMicrosoft Sentinel

Microsoft Entra ID·AuditLogs

AuditLogs
| where TimeGenerated > ago(1d)
| where OperationName in ("Invite external user", "Add user", "Redeem external user invite")
| extend TargetUPN = tostring(TargetResources[0].userPrincipalName)
| extend Initiator = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| where TargetUPN has "#EXT#" or OperationName == "Invite external user"
| project TimeGenerated, Initiator, TargetUPN, OperationName, CorrelationId
| sort by TimeGenerated desc

Microsoft (adapted) · last tested 2025-03-01

Tuning notes

B2B collaboration with partners generates legitimate guest invitations. Cross-reference with approved external domains and exclude known partner domains.

+ Add another query for this technique →