All Detections

Azure App Service PublishXML Action

avatar
Ibrahim Saud@tektrix
updated Jun 18, 2026002

Detects abuse of the microsoft.Web/sites/publishxml/action operation to retrieve application publishing profiles and basic auth credentials.

Microsoft Sentinel (KQL)