Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,650
9,755
6,688
4,418
3,745
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
KQL Query from file: Azure Cloud Security Monitoring
KQL Query
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
KQL Query from file: Monitor Privilege User SSPR
KQL Query
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Monitor Azure API Secrets Extraction
KQL Query
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query from file: Entra Passkey Addition Threat Detection
KQL Query from file: Overprivileged Admin-Consented OAuth Applications
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query
KQL Query from file: Entra ID Administrative Role (AD-Sync)
Page 44 of 55