Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
KQL Query from file: Kerberos Roasting Detection
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitor Privilege User SSPR
KQL Query from file: Password Spraying Detection in Active Directory
KQL Query
KQL Query from file: ClickFix social engineering attack detection
KQL Query
KQL Query from file: High-Risk assets with command line credentials
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Entra User Account Compromised by C2
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: DefenderXDR LDAP Enumeration Detection
Page 173 of 206