Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: ATP Detection for Critical Identities
KQL Query
KQL Query
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: Detecting Phishing Emails with Cloudflare R2 URLs
KQL Query from file: LockBit Black Ransomware
KQL Query
This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls.
This query visualises total inbound emails which has any Bulk complaint level.
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: DISCOVERY: Obsolete device connecting to Entra
KQL Query
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: Entra Risk Events & MITRE ATT&CK Analysis
KQL Query from file: DocuShield - NRT Anti-Impersonation Email Purge
Page 178 of 235