Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,937
7,246
6,535
3,864
3,628
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query from file: Sneaky 2FA MDO Detection
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query from file: Detecting Mamba 2FA phishing-as-a-service
KQL Query
KQL Query
KQL Query from file: User Sign-in Activity
KQL Query from file: OAuth app using the OD file picker permission
KQL Query
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
This query visualises top 10 users targeted with Spam.
KQL Query from file: Detecting New Copilot Extensions
KQL Query from file: MS Teams DLP Playbook
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
KQL Query
KQL Query
KQL Query from file: Detecting EXO MS Graph Enumeration Attacks
KQL Query from file: Email Campaign - Exploiting SVG Files and trycloudflare.com to Spread Malware
KQL Query from file: Hunting New Variant of Snake Keylogger
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Threat Hunting Nation State Actors
Page 126 of 150