Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
KQL Query
KQL Query from file: New Threat Actor Group Signature
KQL Query
KQL Query
KQL Query
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Threat Hunting Nation State Actors
KQL Query
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: ATP Detection for Critical Identities
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: DISCOVERY: Obsolete device connecting to Entra
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query
KQL Query from file: Phishing campaigns leveraging Microsoft Forms
KQL Query
Page 49 of 59