Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,122
15,644
12,592
8,402
6,229
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: Malware C2 Comms over Azure Blob Metadata
KQL Query from file: KQL to check Azure API spray attacks
KQL Query
KQL Query
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query from file: Phishing campaigns leveraging Microsoft Forms
KQL Query
KQL Query
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query from file: Detect & mitigate potential Specula Exploitation
KQL Query from file: KQL URL Protection Report
KQL Query
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 10032025
KQL Query
Detects DNS queries for specific subdomains associated with the "Put.io" sharing website. This activity could indicate command and control communication, data exfiltration, or other malicious use by adversaries.
KQL Query
KQL Query from file: Defending against dot zip domain phishing attack
Page 181 of 190