Library
Community-shared Detection Skills. Run them as-is, or fork one and adapt it to your environment.
- 1
Network Recon Scanning
triage/network-recon-scanning
149
exports
- 2
Application AI Sensitive Data Exposure
triage/application-ai-sensitive-data-exposure
81
exports
- 3
MFA Deepdive
investigation/mfa-deepdive
73
exports
- 4
Network Exposed Service Exploitation
triage/network-exposed-service-exploitation
64
exports
- 5
Identity Authentication Abuse
triage/identity-authentication-abuse
59
exports
- 6
Application Data Exfiltration Oversharing
triage/application-data-exfiltration-oversharing
54
exports
- 7
Endpoint Execution Payload Delivery
triage/endpoint-execution-payload-delivery
51
exports
- 8
MFA Fatigue Baseline
triage/mfa-fatigue-baseline
49
exports
- 9
Admin Role Duty Noise
tuning/admin-role-duty-noise
45
exports
- 10
Cloud Recon Secret Harvest
triage/cloud-recon-secret-harvest
44
exports
- 11
Endpoint Recon Lateral Movement
triage/endpoint-recon-lateral-movement
44
exports
- 12
Endpoint Destructive Impact
triage/endpoint-destructive-impact
42
exports
- 13
Application AI Tooling Supply Chain
triage/application-ai-tooling-supply-chain
33
exports
- 14
Application AI Claude Code Context Poisoning
triage/application-ai-claude-code-context-poisoning
31
exports
- 15
Business Email Compromise Investigation
investigation/business-email-compromise-investigation
31
exports
- 16
C2 Beacon Investigation
investigation/c2-beacon-investigation
31
exports
- 17
Trusted Infrastructure Noise
tuning/trusted-infrastructure-noise
30
exports
- 18
Inbox Rule Abuse Triage
triage/inbox-rule-abuse-triage
29
exports
- 19
Risk Based Alerting
triage/risk-based-alerting
28
exports
- 20
Application Delivered Threat
triage/application-delivered-threat
27
exports
- 21
Application Control Policy Tampering
triage/application-control-policy-tampering
26
exports
- 22
Kerberoasting Triage
triage/kerberoasting-triage
25
exports
- 23
Lateral Movement Investigation
investigation/lateral-movement-investigation
25
exports
- 24
Data Exfiltration Investigation
investigation/data-exfiltration-investigation
24
exports
- 25
AI Agent Incident Investigation
investigation/ai-agent-incident-investigation
23
exports
- 26
Phishing Campaign Investigation
investigation/phishing-campaign-investigation
22
exports
- 27
Suspicious MFA Enrollment Triage
triage/suspicious-mfa-enrollment-triage
22
exports
- 28
macOS Clickfix Loader
triage/macos-clickfix-loader
21
exports
- 29
Application AI Agent Action Abuse
triage/application-ai-agent-action-abuse
20
exports
- 30
Cloud IAM Privilege Persistence
triage/cloud-iam-privilege-persistence
20
exports
- 31
Application AI Prompt Injection
triage/application-ai-prompt-injection
19
exports
- 32
Service Account Noise
tuning/service-account-noise
19
exports
- 33
Cloud Security Control Evasion
triage/cloud-security-control-evasion
18
exports
- 34
Identity Directory Reconnaissance
triage/identity-directory-reconnaissance
18
exports
- 35
Identity App Token Device Foothold
triage/identity-app-token-device-foothold
17
exports
- 36
Network Egress Exfiltration
triage/network-egress-exfiltration
17
exports
- 37
Endpoint Persistence Privesc
triage/endpoint-persistence-privesc
16
exports
- 38
Identity Control Tampering
triage/identity-control-tampering
16
exports
- 39
impossible-travel-triage
triage/impossible-travel-triage
16
exports
- 40
Endpoint Credential Theft
triage/endpoint-credential-theft
15
exports
- 41
Endpoint Defense Evasion Tampering
triage/endpoint-defense-evasion-tampering
15
exports
- 42
Identity Privilege Account Provisioning
triage/identity-privilege-account-provisioning
15
exports
- 43
Application Account Auth Abuse
triage/application-account-auth-abuse
14
exports
- 44
Application Web App Exploitation
triage/application-web-app-exploitation
14
exports
- 45
Cloud Data Exfiltration Destruction
triage/cloud-data-exfiltration-destruction
14
exports
- 46
Network Anonymized C2 Traffic
triage/network-anonymized-c2-traffic
14
exports
- 47
Application AI Guardrail Config Tampering
triage/application-ai-guardrail-config-tampering
13
exports
- 48
Application AI Service Hijack
triage/application-ai-service-hijack
12
exports
- 49
impossible-travel-tuning
tuning/impossible-travel-tuning
12
exports
- 50
oauth-consent-phishing-investigation
investigation/oauth-consent-phishing-investigation
9
exports
- 51
Identity Authenticator Enrollment Hijack
triage/identity-authenticator-enrollment-hijack
3
exports
- 52
Identity Preauth Account Probing
triage/identity-preauth-account-probing
2
exports
- 53
Cloud Network Perimeter Exposure
triage/cloud-network-perimeter-exposure
1
exports
- 54
Cloud Stolen Credential First Use
triage/cloud-stolen-credential-first-use
1
exports
- 55
Identity Authentication-Artifact Pivot
triage/identity-authentication-artifact-pivot
1
exports
- 56
Identity Legacy Auth Flow Bypass
triage/identity-legacy-auth-flow-bypass
1
exports
- 57
Application CICD Pipeline Abuse
triage/application-cicd-pipeline-abuse
0
exports
- 58
Cloud Compute Hijack Provisioning
triage/cloud-compute-hijack-provisioning
0
exports
- 59
Cloud Container Workload Control Plane
triage/cloud-container-workload-control-plane
0
exports
- 60
Cloud Cross Boundary Delegation Use
triage/cloud-cross-boundary-delegation-use
0
exports
- 61
Cloud Workload Code Execution
triage/cloud-workload-code-execution
0
exports