Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,585 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
Detects macOS launchd entries that are not part of the standard Apple system, which could indicate persistence mechanisms used by malware; it is an invalid rule due to a future date.
This detection rule identifies when Microsoft Copilot Studio agent properties are modified in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
KQL Query
Generic rule content from file: Initial Access - Probable Rogue ScreenConnect Session
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
KQL Query from file: GraphRunner Recon Detection & Response
Detects execution of mshta.exe from explorer.exe with an inline HTA script that reads and executes code from the registry.
KQL Query from file: Threat Hunting AzureHound Usage
Detects suspicious execution of mshta.exe from cmd.exe with embedded JavaScript and registry modifications.
KQL Query from file: Azure Cloud Security Monitoring
SPL Query
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query
KQL Query from file: ClickFix_Registry_Related_Artefacts
SPL Query from file: AWS CreateAccessKey
KQL Query from file: FileFix Detection
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
KQL Query from file: Monitor Privilege User SSPR
Search Common EventCodes (EventID’s) for Suspicious Behavior
KQL Query from file: Detecting External Microsoft Teams Spray
Page 467 of 600