Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,586 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: Detecting M365 Copilot Shared Agent
KQL Query
KQL Query from file: Nation State Actors via Microsoft Graph
KQL Query
KQL Query
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
KQL Query from file: Fortigate Belsen Leak KQL Check
KQL Query
KQL Query
KQL Query from file: Critical Identities OAuth Grant
KQL Query
KQL Query from file: Potential Notepad++ CVE-2025-49144 Exploitation
KQL Query
KQL Query
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Conditional Access Report
KQL Query from file: BadSuccessor Detection
KQL Query from file: Hunting malicious oauth grant by phished user
KQL Query from file: MDE: Detecting Quick Assist Usage
KQL Query
Page 469 of 600