Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,587 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
Search Common EventCodes (EventID’s) for Suspicious Behavior
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query
KQL Query
KQL Query from file: High-Risk assets with command line credentials
KQL Query
KQL Query from file: Monitor Copilot Agent for SharePoint
KQL Query
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query
KQL Query
KQL Query from file: The Hunt for QR Phisher
KQL Query from file: Sentinel UEBA Privilege Escalation Detection
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: Entra User Account Compromised by C2
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query from file: Detecting EDR-killing Tool
Page 468 of 600