Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects remote thread creation in uncommon target processes such as 'calc.exe', 'notepad.exe', 'mspaint.exe', 'ping.exe', 'sethc.exe', 'spoolsv.exe', 'wordpad.exe', and 'write.exe'. This activity can indicate process injection techniques used for defense evasion or privilege escalation.
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Azure Cloud Security Monitoring
SPL Query
KQL Query from file: DefenderXDR - Devman Ransomware Detection
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
KQL Query
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
KQL Query from file: Monitor Privilege User SSPR
Search Common EventCodes (EventID’s) for Suspicious Behavior
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query
KQL Query from file: High-Risk assets with command line credentials
KQL Query
KQL Query from file: Monitor Copilot Agent for SharePoint
KQL Query
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
Page 291 of 401