Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Exploring M365 Accounts Investigation
KQL Query
KQL Query from file: BadSuccessor Detection
KQL Query from file: EntraFalcon Detection
KQL Query from file: Hunting Rockstar 2FA
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query from file: MailItemsAccessed Defense
KQL Query from file: Entra Passkey Addition Threat Detection
KQL Query from file: Detecting High Risk Passkey Users
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query from file: Detecting Mamba 2FA phishing-as-a-service
KQL Query
KQL Query from file: Azure cloud account takeover
KQL Query from file: Check for Entra Legacy TLS Login
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
Page 41 of 51