704 detections live

Production-ready detections
for every ATT&CK technique.

704 KQL + SPL detection rules covering all 14 MITRE ATT&CK tactics. Built by defenders, for defenders. Free tier forever — Pro playbooks and atomic tests at £29/mo.

Browse the Matrix Search Detections

Copy. Paste. Detect.

Real queries for real SIEMs. No pseudocode.

T1059.001 — PowerShell Execution KQL

// Microsoft Sentinel / Defender for Endpoint
DeviceProcessEvents
| where FileName in~ ("powershell.exe",
    "pwsh.exe")
| where ProcessCommandLine has_any (
    "-EncodedCommand",
    "-e ", "-ec ",
    "FromBase64String",
    "IEX", "Invoke-Expression")
| project Timestamp, DeviceName,
    AccountName, ProcessCommandLine

T1059.001 — PowerShell Execution SPL

`sysmon` EventCode=1
  (OriginalFileName="PowerShell.EXE"
   OR OriginalFileName="pwsh.dll")
  (CommandLine="*-EncodedCommand*"
   OR CommandLine="*FromBase64String*"
   OR CommandLine="*IEX*"
   OR CommandLine="*Invoke-Expression*")
| table _time host user CommandLine
    ParentCommandLine
| sort - _time

KQL + SPL

Every detection ships with both Microsoft Sentinel (KQL) and Splunk (SPL) queries. Real table names, real event IDs.

ATT&CK Mapped

Sub-technique level coverage across all 14 tactics. Navigate by matrix, search by keyword, filter by tactic.

False Positive Guidance

Known false positive sources documented for every rule. Tune faster, alert less.

Response Playbooks Pro

Step-by-step response procedures per technique. Containment, eradication, recovery — not generic templates.

Atomic Tests Pro

Validate your detections fire. Copy-paste atomic red team commands mapped to each technique.

Hunting Queries Pro

Proactive threat hunting queries that find different patterns than the main detection rules.

Browse detections by ATT&CK tactic

All 14 MITRE ATT&CK tactics, every technique mapped to copy-paste detections.

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact

Popular detections

Cornerstone techniques defenders look for first.

Kerberoasting (T1558.003) Credential access via Kerberos service-ticket cracking.
PowerShell Execution (T1059.001) Encoded and obfuscated PowerShell command execution.
Process Injection (T1055) Code injection into legitimate processes for evasion.
Credential Dumping (T1003) OS credential theft from LSASS, SAM, and more.
Remote Access Software Abuse (T1219) Adversary use of legitimate RMM tools for access.
Virtualization/Sandbox Evasion (T1497.001) System-checks malware uses to detect analysis environments.

Production-ready detectionsfor every ATT&CK technique.