Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects potential malicious use of LDAP queries associated with Metasploit activity targeting Active Directory. LDAP enumeration can reveal detailed information about users, groups, computers, and other objects within a network that can be exploited by attackers.
KQL Query
KQL Query from file: NauthNRPC Detection
KQL Query from file: PowerShell-Based Event Log Clearing
KQL Query from file: DEVMAN ransomware detection
DEVMAN Ransomware Detection
KQL Query
Identifies execution of the mshta LOLBAS utility with command arguments containing the http/https or ftp keyword, which could indicate that an attacker is executing a remotely hosted malicious file for possible code execution AND/OR attempting to ingress a file. Seen in campaigns like lumma stealer.
KQL Query from file: Malicious NPM Package post install script
KQL Query
KQL Query from file: DefenderXDR - Devman Ransomware Detection
Detection looks for Powershell used with various cmdlets used to add certain filetypes to Defender AV exclusion, they would normally be blocked upon execution in certain ways. Allows an actor to execute their own files that normally would be blocked.
KQL Query from file: Potential Session/Cookie Theft
KQL Query from file: FileFix Detection
KQL Query from file: Suspicious CLI Obfuscation
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: ClickFix social engineering attack detection
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query from file: High-Risk assets with command line credentials
KQL Query
Page 476 of 509