Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the "ClickFix" tactic used by the Kimsuky group, where users are tricked into executing malicious PowerShell commands. This includes techniques like reverse-string obfuscation and the use of specific junk strings to evade detection.
KQL Query
SPL Query
Detects mshta.exe (or renamed instances) being spawned by winword.exe, a common technique used in phishing attacks.
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: Azure cloud account takeover
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query
KQL Query from file: KQL URL Protection Report
KQL Query
KQL Query
KQL Query from file: APT Stealth Falcon - CVE-2025-33053 Detection
KQL Query from file: BlueAlpha GammaDrop Detection
KQL Query from file: Hunting NonEuclid RAT
KQL Query
KQL Query from file: Any.Run Corrupt File Zero Day Attack
KQL Query
Page 78 of 86