Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,154 detections
Filters
Last updated
All Time
Detection languages
695
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
701
220
196
148
Platforms
1,121
187
161
59
51
Products / Services
10,670
9,758
6,693
4,421
3,749
1,154
MITRE Techniques
700
429
360
209
198
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Azure Cloud Security Monitoring
KQL Query
KQL Query from file: Monitoring Cross-Tenant Abuse by Threat Actors
KQL Query from file: Monitor Privilege User SSPR
KQL Query
KQL Query
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query
KQL Query from file: Critical Identities OAuth Grant
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Monitor Azure API Secrets Extraction
KQL Query
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query from file: Entra Passkey Addition Threat Detection
KQL Query from file: Overprivileged Admin-Consented OAuth Applications
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query
Page 44 of 55