CQL Hubby ByteRay
← All queries

OAuth2 Token Burst — Token Harvesting (Microsoft Defender for Identity)

CQL · Falcon Next-Gen SIEMCopy query
Loading query…
oauth2_token_burst_token_harvesting_microsoft_defender_for_identity.yml
Detection
Identity
Identity

Want this running in your SIEM — with someone on call?

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team
ByteRay GmbH
Hopfenstraße 8
80335 Munich
Germany
Security incident? 24/7 hotline +49 89 2000 7683
ByteRay is a German cybersecurity company for Managed Detection & Response, Digital Forensics & Incident Response and Next-Gen SIEM — specialised in the CrowdStrike Falcon platform. BSI-listed, based in Munich.
Services
Incident ResponseManaged CSIRTSIEM EngineeringFoundry AppsCQL Hub
Company
About usContactPGP keyDeutsche Website
© 2026 ByteRay GmbH
Legal NoticePrivacy PolicyTerms and Conditions