MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1557Adversary-in-the-Middle

Credential AccessCollection

View on MITRE ATT&CK →

1 Query

Potential Adversary-in-the-Middle Phishing via OfficeHome Application

hightestingMicrosoft Sentinel

Microsoft Entra ID·SigninLogs

SigninLogs
| where TimeGenerated > ago(1d)
| where AppDisplayName == "OfficeHome"
| where UserPrincipalName has "@"
| extend deviceId = tostring(DeviceDetail.deviceId)
| where isempty(deviceId)
| summarize RiskLevels = make_set(RiskLevelDuringSignIn), ResultTypes = make_set(ResultType), IPs = make_set(IPAddress) by CorrelationId, UserPrincipalName, IPAddress, Location
| sort by UserPrincipalName asc

Bert-JanP (adapted) · last tested 2025-03-01

attack.mitre.org
github.com
techcommunity.microsoft.com

Tuning notes

BYOD environments will have higher baseline of empty deviceId sign-ins. Cross-reference with RiskLevelDuringSignIn values — filter to only 'medium' or 'high' risk for lower false-positive rate.

+ Add another query for this technique →