Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects macOS launchd entries that are not part of the standard Apple system, which could indicate persistence mechanisms used by malware; it is an invalid rule due to a future date.
Detects PowerShell creating executable files or script files. This rule specifically looks for PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files with common executable or script extensions to disk, while filtering out common temporary file locations and PowerShell module paths to reduce false positives.
Detection of potentially malicious activities on Windows systems related to Sysmon events, focusing on executable files, registry changes, and network connections.
KQL Query from file: Detecting Blind Eagle APT-C-36
KQL Query from file: Detecting EDR-killing Tool
KQL Query
KQL Query from file: defendnot detection
KQL Query
KQL Query
KQL Query
KQL Query from file: Threat Hunting BYOVD Scenarios
KQL Query
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query from file: Hunting Malicious Chrome Extension
KQL Query
KQL Query from file: Ottercookie Detection
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query
KQL Query
KQL Query
Page 201 of 216