Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,445
11,833
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query
KQL Query from file: Hunting Malicious Copilot Agent
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Conditional Access Report
KQL Query from file: BadSuccessor Detection
KQL Query from file: Azure Storage Blob - Misconfiguration Check
KQL Query from file: Monitor Azure API Secrets Extraction
KQL Query from file: Entra Passkey Addition Threat Detection
KQL Query from file: Overprivileged Admin-Consented OAuth Applications
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query
KQL Query from file: Entra Admin Roles Query
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query
KQL Query from file: Entra QR Code Sign-In KQL Detection
KQL Query from file: Azure AI Security Finding Report
KQL Query
Page 114 of 144