Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing.
It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
KQL Query from file: Identity Blast Radius
KQL Query
KQL Query from file: Tracking Proton66 Activity with KQL
KQL Query from file: Hunting NonEuclid RAT
KQL Query
KQL Query
KQL Query from file: Monthly Report Entra Eligible Role Activation
KQL Query
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
KQL Query from file: Seashell Blizzard (IRIDIUM) - PWS:Win64-HighCount
KQL Query
The following analytic detects instances of DLLHost.exe running without command line arguments while establishing a network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network activity data. It is significant because DLLHost.exe typically runs with specific arguments, and its absence can indicate malicious activity, such as Cobalt Strike usage. If confirmed malicious, this activity could allow attackers to execute code, move laterally, or exfiltrate data, posing a severe threat to the network's security.
KQL Query from file: Hunting AI Recall on Windows 11 24H2
KQL Query
KQL Query
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
Detects potential COM object hijacking via modification of default system CLSID.
KQL Query
KQL Query from file: RID Hijacking Technique and Detection
Page 298 of 401