Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
KQL Query
KQL Query from file: Ottercookie Detection
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query
KQL Query
KQL Query
KQL Query from file: Chrome extension stealth persistence detection
KQL Query from file: CVE-2025-32705 Out-of-bounds Read Detection
KQL Query
KQL Query
KQL Query from file: KQLWiz PDF NTLM Leak Detector
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 12052025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 10032025
KQL Query from file: Hunting chrome extension with hidden tracking
KQL Query from file: psexecsvc.py detection
KQL Query
KQL Query from file: APT Stealth Falcon - CVE-2025-33053 Detection
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query from file: Cookie-Bite Detection
KQL Query
Page 202 of 217