Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
KQL Query from file: Hunting fasthttp Bruteforce Campaign
KQL Query from file: Detecting GOLDEN SAML Attack
KQL Query from file: Entra Passkey Addition Threat Detection
KQL Query from file: Detecting High Risk Passkey Users
KQL Query
KQL Query from file: Overprivileged Admin-Consented OAuth Applications
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query from file: CloudApp Suspicious Copilot Agent Detection
KQL Query
KQL Query from file: Entra Admin Roles Query
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query
KQL Query from file: Azure cloud account takeover
KQL Query
KQL Query from file: Entra QR Code Sign-In KQL Detection
KQL Query from file: Check for Entra Legacy TLS Login
KQL Query from file: User Sign-in Activity
KQL Query from file: OAuth app using the OD file picker permission
KQL Query
Page 158 of 184