Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
187 detections
Filters
Last updated
All Time
Detection languages
153
11
11
7
3
Contributors
47
34
22
16
7
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
101
57
50
32
23
Products / Services
70
20
19
13
12
MITRE Techniques
86
71
56
52
33
CVEs
5
5
5
4
4
IDS Classtypes
7
4
IDS Protocols
10
1
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query
KQL Query
KQL Query from file: CVE-2025-29824 PipeMagic Detection
KQL Query from file: CVE-2024-38063 CVSS 9.8 Prioritization
KQL Query
KQL Query from file: CVE-2025-21298 Zero-Click RCE
KQL Query
KQL Query
KQL Query from file: CVE-2025-4664 Chrome flaw with public exploit
KQL Query
KQL Query from file: CVE-2024-43452 PoC Detection
KQL Query from file: Finding internet facing device with CUPS
KQL Query from file: Git Critical Vulnerability CVE-2024-32002
KQL Query from file: Detect CVE-2024-31497
'Potential code injection into web server roles via IIS logs scan. Represents attempt to gain initial access using drive-by compromise technique. Detection flags events for review and filtering of authorized activity.'
Microsoft has observed attackers exploiting vulnerabilities associated with Log4J.
Search for the CVEs that should be prioritized and resolved to reduce the success of the FireEye Red Team tools compromised by the Nobelium activity group.
See red_team_tool_countermeasures on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/CVEs_red_team_tools.md
https://github.com/fireeye
See red_team_tool_countermeasures on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/CVEs_red_team_tools.md
https://github.com/fireeye
'This query combines different SQL alerts with CommonSecurityLogs and AuditLogs helping analysts /investigate any possible SQL related attacks faster
thus reducing Mean Time To Respond'
thus reducing Mean Time To Respond'
Detect Active Directory LDAP queries that try to find operating systems that are vulnerable to specific vulnerabilities
This LDAP query cover MetaSploit - enum_ad_computers tool
This LDAP query cover MetaSploit - enum_ad_computers tool
'Detects suspicious user agent strings used by known hack tools'
Page 8 of 9