Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects DNS queries for domains known to be used by the DarkCloud campaign for payload delivery and C2 communication. This rule specifically targets domains used for initial payload download, final payload delivery, and public IP address determination.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance.
This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.
Detects network traffic to command and control (C2) servers associated with the Katz Stealer malware, identified by known IP addresses and domains.
Detects network traffic to known Command and Control (C2) IP addresses associated with the SuperBlack ransomware.
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
Detects network traffic to known Command and Control (C2) IP addresses used by the Mora_001 group for their SuperBlack ransomware operations.
KQL Query
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query
KQL Query
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query
KQL Query from file: Conditional Access Report
KQL Query
KQL Query from file: Threat hunting voice phishing for Teams
KQL Query from file: MailItemsAccessed Defense
KQL Query from file: Detecting GOLDEN SAML Attack
KQL Query from file: Detecting High Risk Passkey Users
Page 54 of 60