Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
KQL Query
KQL Query
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query
KQL Query
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query from file: Monitor Copilot Agent for SharePoint
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: Hunting Malicious Copilot Agent
KQL Query
KQL Query from file: Detecting Abuse of Wevtutil.exe in LOLBAS Attacks
KQL Query
KQL Query
KQL Query
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query
Page 114 of 128