Leaderboard
Month of: October
Updated daily. Last refreshed October 7, 2026 at 4:12 PM UTC.
October Leaderboard
Description
We're continuing in October with an engagement leaderboard. The more community members engage with your content, the higher you'll rank! We're tracking two types of engagement: -Downloads -Copies (keyboard, button, or workspace)
Rewards
🎟️ The top 3 contributors in October will receive: - First Place: $200 gift card - Second Place: $100 gift card - Third Place: $50 gift card 🎁 Contributors placing 4th - 10th will receive custom contributor-only detections.ai swag! NOTE: We monitor for activity intended to inflate leaderboard standings, and we'll remove offending accounts from the board. The leaderboard is here to show whose detections other engineers are actually using.
Top 9
Most liked by You
@Secvyn
Detection:
Check Vulnerable Citrix NetScaler
@KQLWizard
Detection:
Hunting Adversaries Abusing Google GoTo URLs
@KQLWizard
Detection:
Hunting Anthropic AI Model Hacking
@KQLWizard
Detection:
TerminalFix Detection
@Secvyn
Detection:
Tunneling tool (ngrok/Cloudflare) execution or C2 domain contact
@timpeck
Detection:
T1204.001: ClickFix Win+R PowerShell IEX/IRM Remote Script Execution
@Secvyn
Detection:
Process unhooks ntdll/amsi/win32kbase before LSASS clone dump
@Secvyn
Detection:
Known-malicious 'VPN for X' proxy extension CRX build hash match
@KQLWizard
Detection:
Detect Teams-based Helpdesk Impersonation Attack (Mail Bomb follow by social engineering attack)
@KQLWizard
Detection:
Defender XDR Threat Entities Abusing Cloudflare
@slaz
Detection:
Passkey/SSO phishing domain access (Storm-3121/Storm-3032)
@Secvyn
Detection:
ClickFix via Hijacked third-party[.]com Placeholder Domain - PowerShell irm/iex from Run Dialog
Come build with us
Join the community that moves faster than the threat.
Running a detection team? See Enterprise →