Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
KQL Query from file: CVE-2024-26234 and CVE-2024-29988
KQL Query
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
KQL Query from file: Detecting Copilot Studio Bot Creation
KQL Query from file: Detect LNK Stomping
KQL Query
KQL Query
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
KQL Query
KQL Query from file: Threat Hunting Microsoft Sway Quishing
KQL Query
KQL Query from file: Detect Copilot Plugin Installation
KQL Query
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
Detects uncommon processes creating remote threads.
KQL Query from file: CVE-2025-29824 PipeMagic Detection
KQL Query from file: CVE-2024-38063 CVSS 9.8 Prioritization
Low Privileged process spawning elevated process from remote session
Detects potential abuse of the Windows on-screen keyboard (osk.exe) by replacing it with cmd.exe or spawning unusual processes as SYSTEM. This technique can be used for persistence via accessibility features.
KQL Query
Page 297 of 401