Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects network communication patterns associated with the SparkKitty mobile spyware, which exfiltrates sensitive data, including images, by connecting to known command and control servers or using specific API endpoints.
KQL Query
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query
KQL Query
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query from file: Entra User Account Compromised by C2
KQL Query
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: Hunting Malicious Copilot Agent
KQL Query
KQL Query from file: Hunting malicious oauth grant by phished user
KQL Query
KQL Query
KQL Query
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query
KQL Query
KQL Query from file: Check for Entra Legacy TLS Login
Page 101 of 124