Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,936
7,266
6,537
3,866
3,647
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Technique profile eDiscovery misuse detection
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
KQL Query from file: Exposure Management + Defender for Office 365
KQL Query from file: Detecting Phishing Emails with Cloudflare R2 URLs
KQL Query from file: LockBit Black Ransomware
This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls.
This query visualises total inbound emails which has any Bulk complaint level.
KQL Query from file: DISCOVERY: Obsolete device connecting to Entra
KQL Query from file: Hunting DragonForce with ANY.RUN Threat Intelligence
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query from file: Phishing campaigns leveraging Microsoft Forms
KQL Query from file: Brands Impersonation Phishing Trend
KQL Query from file: Perimeter Defense - Attack Surface Reduction
KQL Query from file: OAuth App for BEC & Phishing Detection
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
KQL Query from file: Detecting Teams Red Team Tool ConvoC2
This query visualises total inbound emails which has any Bulk complaint level.
KQL Query from file: M365 Copilot Chat SafeLink Monitoring
KQL Query from file: M365 Copilot Extensions Threat Monitoring
KQL Query from file: CVE-2025-32705 Out-of-bounds Read Detection
Page 127 of 150