Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
KQL Query
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
Detects PowerShell download and execution cradles.
KQL Query from file: Mitigating security risks in MCP implementations
KQL Query
KQL Query
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
SPL Query from file: Powershell encoded command observed
KQL Query from file: Identity Blast Radius 2
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
KQL Query from file: APT Stealth Falcon - CVE-2025-33053 Detection
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query from file: Cookie-Bite Detection
KQL Query
KQL Query
KQL Query from file: BlueAlpha GammaDrop Detection
KQL Query from file: PowerShell Self-Pwn
KQL Query from file: Detecting Windows Downdate Abuse
Page 132 of 155