Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects unauthorized or suspicious USB device connections based on manufacturer, product, and device ID indicators.
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
KQL Query from file: Hunting Exposed JDWP
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects the execution of the `sudo` command with the `chroot` option (`-C` or `--chroot`). This could be an indicator of an attempt to exploit privilege escalation vulnerabilities like CVE-2025-32463.
KQL Query from file: Suspicious CLI Obfuscation
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query from file: Discord Invite Hijacking Detection
KQL Query
KQL Query from file: Detect CVE-2025-27607 (CVSS 8.8)
KQL Query
KQL Query
KQL Query
Page 313 of 340