Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,665 detections
Filters
Last updated
All Time
Detection languages
10,181
119
110
99
60
Contributors
2,815
2,800
1,768
504
492
Categories
4,275
2,971
2,237
1,829
1,457
Platforms
10,376
1,102
802
155
98
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
DEVMAN Ransomware Detection
KQL Query
Identifies execution of the mshta LOLBAS utility with command arguments containing the http/https or ftp keyword, which could indicate that an attacker is executing a remotely hosted malicious file for possible code execution AND/OR attempting to ingress a file. Seen in campaigns like lumma stealer.
KQL Query from file: Malicious NPM Package post install script
KQL Query
KQL Query from file: DefenderXDR - Devman Ransomware Detection
Detection looks for Powershell used with various cmdlets used to add certain filetypes to Defender AV exclusion, they would normally be blocked upon execution in certain ways. Allows an actor to execute their own files that normally would be blocked.
KQL Query from file: Potential Session/Cookie Theft
KQL Query from file: FileFix Detection
KQL Query from file: Suspicious CLI Obfuscation
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: ClickFix social engineering attack detection
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query from file: High-Risk assets with command line credentials
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Detecting Blind Eagle APT-C-36
KQL Query from file: DefenderXDR LDAP Enumeration Detection
KQL Query from file: Detecting EDR-killing Tool
KQL Query
Page 476 of 508