KQL detection library for Azure/Sentinel
Source Reddit BlueTeam
Discussion
This is an announcement of a KQL (Kusto Query Language) detection library for Microsoft Azure Sentinel and Defender for Cloud. The library contains 32 production-quality detection rules mapped to MITRE ATT&CK tactics for cloud environments. The rules cover various attack techniques such as credential access, initial access, privilege escalation, lateral movement, exfiltration, persistence, defense evasion, discovery, execution, and impact. Each rule includes descriptions, false positive considerations, and tuning notes to facilitate practical deployment. The library is intended to enhance detection capabilities in Azure Sentinel environments.
r/blueteamsec (opens in a new tab)u/Ok-Code43060 points0 comments
Put together a KQL detection library for Azure/Sentinel — 32 rules across 10 MITRE ATT&CK tactics. Each rule has description, false positive considerations, and tuning notes baked into the file so it's actually usable in production without guesswork.
Covers things like MFA fatigue, impossible travel, federated identity credential abuse, Conditional Access policy modification, VM extension installation, and subscription ownership transfer — some of the less commonly documented ones.