Categories

Browse 31,282 rules by source, platform, severity, language, and MITRE tactic.

By Source

Sigma

4,021

rules
Splunk

2,115

rules
Elastic

2,094

rules
Microsoft Sentinel

2,308

rules
Panther

1,077

rules
Sublime Security

1,427

rules
Google Chronicle

922

rules
Anvilogic

1,897

rules
Falco

103

rules
YARA

12,439

rules
Wazuh

2,879

rules

By Platform

Windows

22,100

71% of rules
Linux

17,013

54% of rules
macOS

1,928

6% of rules
Cloud

7,433

24% of rules
Network

1,314

4% of rules

By Severity

critical

269

1%
high

4,068

13%
medium

5,454

17%
low

2,901

9%
informational

1,565

5%

By MITRE Tactic

TA0043

Reconnaissance

24

techniques

201

rules
TA0042

Resource Development

21

techniques

111

rules
TA0001

Initial Access

14

techniques

1,053

rules
TA0002

Execution

94

techniques

3,178

rules
TA0003

Persistence

80

techniques

1,987

rules
TA0004

Privilege Escalation

30

techniques

861

rules
TA0005

Defense Evasion

142

techniques

4,553

rules
TA0006

Credential Access

53

techniques

1,770

rules
TA0007

Discovery

50

techniques

1,535

rules
TA0008

Lateral Movement

28

techniques

810

rules
TA0009

Collection

33

techniques

618

rules
TA0010

Exfiltration

23

techniques

557

rules
TA0011

Command & Control

36

techniques

1,458

rules
TA0040

Impact

39

techniques

804

rules
TA0112

Defense Impairment

47

techniques

995

rules

By Detection Language

⊕ YARA

12,439

40%
∑ Sigma

4,021

13%
| SPL

3,580

11%
K KQL

3,228

10%
X XML

2,879

9%
M MQL

1,427

5%
E EQL

1,174

4%
Py Python

1,077

3%
Y YARA-L

922

3%
? Other

535

2%