Same-day detection rules for public exploits. When a weaponized exploit drops, defenders need rules they can deploy now — not in the next vendor signature update.
A curated collection of detection rules built against public, weaponized exploits. Each detection package includes:
- Cortex XDR BIOC — XQL queries ready for the BIOC engine
- Defender KQL — Microsoft Defender for Endpoint detection queries
- Sigma — Generic detection rules (where applicable)
- Gap analysis — What we can detect, what we can't, and why
- Mitigations — Immediate actions that don't require a patch
- A vulnerability database (use NVD)
- An exploit repository (links to source only, never payloads)
- A replacement for vendor signatures (supplement, don't substitute)
- A guarantee (every rule has false positive considerations documented)
detections/
CVE-YYYY-NNNNN/
README.md # Summary, references, detection coverage
xdr-bioc/ # Cortex XDR BIOC XQL queries
defender-kql/ # Microsoft Defender KQL queries
sigma/ # Generic Sigma rules
gaps.md # What cannot be detected and why
mitigations.md # Immediate mitigations
Every rule in this repo meets these criteria:
- Verified fields only. XQL and KQL field names are tested against the platform's actual schema. No invented fields.
- Honest about gaps. If the exploitation primitive isn't telemetered, we say so. False confidence is worse than no detection.
- FP considerations documented. Every rule includes what else triggers it and how to tune.
- Patch status tracked. If the patch is insufficient, that's flagged. Detection without that context is incomplete.
- Attribution to source. Every detection links back to the exploit it was built against.
MIT. Use it, deploy it, improve it. Attribution appreciated but not required.
Maintained by Nextgrid IT