Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
KQL Query
KQL Query from file: CVE-2025-32705 Out-of-bounds Read Detection
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 10032025
KQL Query
KQL Query from file: Threat Hunting Mshta with Sentinel TI
KQL Query from file: Blob URI Unique Domain Count
KQL Query from file: Seashell Blizzard (IRIDIUM) - PWS:Win64-HighCount
KQL Query from file: Any.Run Corrupt File Zero Day Attack
KQL Query
KQL Query from file: Hunting AI Recall on Windows 11 24H2
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 24022025
KQL Query from file: Detecting Windows Downdate Abuse
KQL Query from file: Blob URIs creation trend analysis
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
Detects default file names outputted by the BloodHound collection tool SharpHound
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections
Detects the creation of specific files inside of ProgramData directory.
These files were seen being created by Forest Blizzard as described by MSFT.
These files were seen being created by Forest Blizzard as described by MSFT.
Detects PowerShell writing startup shortcuts.
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.
Detects the creation of the default output filename used by the wmiexec tool
Page 118 of 139