Skip to content

Instantly share code, notes, and snippets.

@CarissaDurko

CarissaDurko/gist:f542c89ac39d946b26b1c8567574f4d9

Created July 7, 2025 17:58
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save CarissaDurko/f542c89ac39d946b26b1c8567574f4d9 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save CarissaDurko/f542c89ac39d946b26b1c8567574f4d9 to your computer and use it in GitHub Desktop.
Download ZIP
KQL Malicious IP Blocks by Domain
Raw
gistfile1.txt
AADSignInEventsBeta
| where ErrorCode == 50053
| where TimeStamp > ago(30d)
| where AccountUPN has "enterdomainhere.com"
| project AccountDisplayName, AccountUPN, AccountObjectId, DeviceName, UserAgent, ClientAppUsed, Browser, Country
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment