Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
KQL Query from file: The Hunt for Top 10 Self Hosted AI
KQL Query from file: Hunting New Variant of Snake Keylogger
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: LockBit Black Ransomware
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
KQL Query from file: NTLMv2 Hash Leak via COM Detection
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query from file: Detecting Teams Red Team Tool ConvoC2
KQL Query from file: CVE-2025-32705 Out-of-bounds Read Detection
KQL Query from file: MDO Email Threat Classification By ISP
KQL Query from file: KQLWiz PDF NTLM Leak Detector
KQL Query
KQL Query
KQL Query from file: MDO Email Threat Classification By Country
KQL Query
KQL Query
Page 147 of 173