Links and metadata only. Inclusion is not endorsement, authorization, safety certification, or proof of completeness. Follow the upstream publisher for current terms and safe deployment guidance.

Reviewed placement

Blue team · Cross-team

Capabilities

Detection engineering
SIEM and logging
Threat hunting

Platforms and deployment

Platforms: Platform neutral
Forms: Dataset or content library

License note

Detection Rule License 1.1 for rules; specification and logo are public domain.

Official links

Official project — official
Canonical repository — repository

Lifecycle evidence

First-party lifecycle evidence was checked on 2026-10-11. Re-review the official links and lifecycle before 2027-04-09.

EVIDENCE CHECKED 2026-10-11T00:00:00+00:00
EDITORIAL REVIEW 2026-10-12T00:54:37+00:00