Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
KQL Query
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Suspicious CLI Obfuscation
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query from file: ClickFix social engineering attack detection
KQL Query from file: High-Risk assets with command line credentials
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
KQL Query
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
Detects PowerShell download and execution cradles.
KQL Query from file: Mitigating security risks in MCP implementations
KQL Query
KQL Query
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
SPL Query from file: Powershell encoded command observed
Page 131 of 154