Open-source detection rules, indexed and cross-referenced.

Sigma, YARA, Suricata, Elastic, Splunk, Falco, Wazuh and more, searchable from one box. One schema across formats, every rule linked back to the file it came from.

81023 detections 15 sources 559 ATT&CK techniques

Tracked sources

sort

Newest detections

42617 et-open hidden · include

Most-covered techniques

top 20

One technique, every rule mapped to it, grouped by source.

T1190 Exploit Public-Facing Application 6613 T1568 Dynamic Resolution 5929 T1566 Phishing 1848 T1059 Command and Scripting Interpreter 1448 T1071 Application Layer Protocol 1071 T1027 Obfuscated Files or Information 896 T1078 Valid Accounts 730 T1041 Exfiltration Over C2 Channel 716 T1218 System Binary Proxy Execution 632 T1059.001 Command and Scripting Interpreter: PowerShell 521 T1562 Impair Defenses 502 T1098 Account Manipulation 501 T1105 Ingress Tool Transfer 406 T1003 OS Credential Dumping 375 T1548 Abuse Elevation Control Mechanism 361 T1685 Disable or Modify Tools 361 T1055 Process Injection 358 T1021 Remote Services 354 T1059.004 Command and Scripting Interpreter: Unix Shell 349 T1574 Hijack Execution Flow 328

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.