Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects the creation of the Tor process from a specific directory using command line arguments indicative of controlling and logging ports.
KQL Query from file: DEVMAN ransomware detection
KQL Query
Analyze Mail Bomb Attack by ISP
KQL Query from file: Threat Hunting AzureHound Usage
Detects network communication patterns associated with the SparkKitty mobile spyware, which exfiltrates sensitive data, including images, by connecting to known command and control servers or using specific API endpoints.
Detection of potentially malicious activities on Windows systems related to Sysmon events, focusing on executable files, registry changes, and network connections.
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: DPRK (Famous Chollima) use of Astrill VPN
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Detecting Blind Eagle APT-C-36
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Entra User Account Compromised by C2
KQL Query from file: Attacker in the Middle Precision Detection
Page 217 of 246