704 detections live

Production-ready detections
for every ATT&CK technique.

704 KQL + SPL detection rules covering all 14 MITRE ATT&CK tactics. Built by defenders, for defenders. Free tier forever — Pro playbooks and atomic tests at £29/mo.

Browse the Matrix Search Detections

Copy. Paste. Detect.

Real queries for real SIEMs. No pseudocode.

T1059.001 — PowerShell Execution KQL

// Microsoft Sentinel / Defender for Endpoint
DeviceProcessEvents
| where FileName in~ ("powershell.exe",
    "pwsh.exe")
| where ProcessCommandLine has_any (
    "-EncodedCommand",
    "-e ", "-ec ",
    "FromBase64String",
    "IEX", "Invoke-Expression")
| project Timestamp, DeviceName,
    AccountName, ProcessCommandLine

T1059.001 — PowerShell Execution SPL

`sysmon` EventCode=1
  (OriginalFileName="PowerShell.EXE"
   OR OriginalFileName="pwsh.dll")
  (CommandLine="*-EncodedCommand*"
   OR CommandLine="*FromBase64String*"
   OR CommandLine="*IEX*"
   OR CommandLine="*Invoke-Expression*")
| table _time host user CommandLine
    ParentCommandLine
| sort - _time

KQL + SPL

Every detection ships with both Microsoft Sentinel (KQL) and Splunk (SPL) queries. Real table names, real event IDs.

ATT&CK Mapped

Sub-technique level coverage across all 14 tactics. Navigate by matrix, search by keyword, filter by tactic.

False Positive Guidance

Known false positive sources documented for every rule. Tune faster, alert less.

Response Playbooks Pro

Step-by-step response procedures per technique. Containment, eradication, recovery — not generic templates.

Atomic Tests Pro

Validate your detections fire. Copy-paste atomic red team commands mapped to each technique.

Hunting Queries Pro

Proactive threat hunting queries that find different patterns than the main detection rules.

Production-ready detectionsfor every ATT&CK technique.