Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
KQL Query from file: Threat Hunting AzureHound Usage
Detects network communication patterns associated with the SparkKitty mobile spyware, which exfiltrates sensitive data, including images, by connecting to known command and control servers or using specific API endpoints.
Detection of potentially malicious activities on Windows systems related to Sysmon events, focusing on executable files, registry changes, and network connections.
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: DPRK (Famous Chollima) use of Astrill VPN
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Detecting Blind Eagle APT-C-36
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Entra User Account Compromised by C2
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query
KQL Query from file: DefenderXDR LDAP Enumeration Detection
KQL Query
KQL Query from file: Nation State Actors via Microsoft Graph
Page 217 of 246