Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
KQL Query from file: Blob URI Unique Domain Count
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
KQL Query from file: Tracking Proton66 Activity with KQL
KQL Query from file: Monthly Report Entra Eligible Role Activation
KQL Query
Detects a suspicious WinRAR execution in a folder which is not the default installation folder
KQL Query
KQL Query from file: Outlook New Requirements for High‐Volume Senders
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
KQL Query from file: glibc critical vulnerability (CVSS 9.8)
KQL Query from file: Hunting VEILDrive C2
KQL Query from file: MDE KQL to detect TA571 socialengineering abuse
KQL Query from file: Muddled Libra
This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain).
This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)
detects a possible IPv6 DNS takeover using ISATAP configuration events (Event ID 4100) new ISATAP router was set successfully
This query visualises user submissions where admin also performed 'mark and notify' action on the submission
The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. It leverages AWS CloudTrail logs and uses the `anomalydetection` command to detect unusual patterns in the frequency of GetObject API calls by analyzing fields such as "count," "user_type," and "user_arn" within a 10-minute window. This activity is significant as it may indicate unauthorized data access or exfiltration from S3 buckets. If confirmed malicious, attackers could exfiltrate sensitive data, leading to data breaches and compliance violations.
This analytic identifies anomalously high outbound network activity from processes within Kubernetes containerized workloads. It compares recent network metrics (TCP/UDP bytes, new sockets, packets) over the last hour against the average metrics from the past 30 days. Significant deviations may indicate data exfiltration, process modification, or container compromise, potentially leading to unauthorized data transfer or further attacks within the containerized environment.
This analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data. It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used. This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets.
Page 148 of 173