Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects file events where the target object path indicates a WebDAV mount point, specifically looking for paths containing '\Device\Mup\;WebDavRedirector\.*\DavWWWRoot\.*' combined with a domain name or IP address. This pattern is often associated with forced authentication attempts or ingress tool transfer via WebDAV.
SPL Query
Detects the creation of known offensive powershell scripts used for exploitation
Detects macOS launchd entries that are not part of the standard Apple system, which could indicate persistence mechanisms used by malware; it is an invalid rule due to a future date.
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: Detecting EDR-killing Tool
KQL Query
KQL Query
KQL Query
KQL Query from file: LLM Hunting in a MDE Environment
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query
KQL Query
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query from file: TA4557 drops More_Eggs
KQL Query from file: The Hunt for Top 10 Self Hosted AI
KQL Query from file: Hunting New Variant of Snake Keylogger
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query
Page 117 of 139