Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
KQL Query from file: TA4557 drops More_Eggs
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
KQL Query
KQL Query
KQL Query from file: New Threat Actor Group Signature
KQL Query
KQL Query
Detects potential PowerShell commands or code within registry run keys
KQL Query
KQL Query from file: Hunting New Variant of Snake Keylogger
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Threat Hunting Nation State Actors
KQL Query
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: ATP Detection for Critical Identities
KQL Query
KQL Query from file: Exposure Management + Defender for Office 365
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query
KQL Query from file: KQL to check Azure API spray attacks
Page 295 of 401