Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
KQL Query from file: Overprivileged Admin-Consented OAuth Applications
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query from file: CloudApp Suspicious Copilot Agent Detection
KQL Query
KQL Query from file: MDO - Enhancing Email Security with NRD Filtering
KQL Query from file: Advanced Vishing KQL Detection
KQL Query from file: M365 Copilot Gone Rouge
KQL Query from file: Entra Admin Roles Query
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query from file: Sneaky 2FA MDO Detection
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query
KQL Query
KQL Query from file: User Sign-in Activity
KQL Query from file: OAuth app using the OD file picker permission
KQL Query
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
This query visualises top 10 users targeted with Spam.
KQL Query from file: Detecting New Copilot Extensions
Page 149 of 179