Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,122
15,644
12,592
8,402
6,229
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query
KQL Query from file: Nation State Actors via Microsoft Graph
KQL Query
KQL Query from file: Critical Identities OAuth Grant
KQL Query
KQL Query from file: MDE: Detecting Quick Assist Usage
KQL Query
KQL Query from file: Azure CLI Spray - ASN 53667
KQL Query from file: Detecting GOLDEN SAML Attack
KQL Query
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query
KQL Query from file: Azure cloud account takeover
KQL Query
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
KQL Query from file: MS Teams DLP Playbook
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
Page 180 of 190