Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
KQL Query
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Entra User Account Compromised by C2
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
KQL Query from file: Entra Cross-Tenant Activity Monitoring
KQL Query from file: Detecting EDR-killing Tool
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
KQL Query from file: Nation State Actors via Microsoft Graph
KQL Query
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
Page 292 of 401