Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,304 detections
Filters
Last updated
All Time
Detection languages
676
264
155
72
49
Contributors
232
195
187
166
110
Categories
344
308
229
217
143
Platforms
472
418
224
173
138
Products / Services
264
262
195
176
104
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,304
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
KQL Query from file: Enhanced Cloudflare Phishing Email Detections
KQL Query
KQL Query from file: Monthly Report Entra Eligible Role Activation
KQL Query
KQL Query from file: CVE-2025-4664 Chrome flaw with public exploit
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
KQL Query
KQL Query
KQL Query from file: Hunt for High Volume Phish ISP
KQL Query from file: Outlook New Requirements for High‐Volume Senders
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
KQL Query from file: Critical Vulnerability in Elastic Kibana
KQL Query from file: Blob URIs creation trend analysis
KQL Query
This detection targets suspicious ROPC (Resource Owner Password Credentials) authentication attempts involving brute-forcing of application client IDs, specifically related to the `Invoke-BruteClientIDs` function in MFA Sweep. This function can be used for enumerating gaps in MFA and/or CA policies, in addition to password validation via credential stuffing.
KQL Query from file: Detect CVE-2024-31497
KQL Query from file: Muddled Libra
This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology
This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
Page 52 of 63