What this project is

The problem it solves

Answering "which projects detect T1059, and how do their rules differ?" currently means cloning thirteen or more repositories, learning seven file formats, and writing throwaway scripts. The rules are public, but they aren't comparable.

This project does that work once. Every tracked project is cloned, parsed into a common shape, and cross-referenced against MITRE ATT&CK, so a technique, a platform, or a piece of telemetry becomes something you can pivot on.

How the index is built

Each source is cloned or downloaded from its own repository, then parsed by a mapper written specifically for its format. A rule becomes one entry per logical rule rather than one per file — multi-rule files like Wazuh XML, Falco YAML, and YARA bundles are split apart, which is why a single file can contribute dozens of entries.

We keep normalization shallow on purpose. Severity is bucketed to five levels because sources variously use 1–100, low/medium/high, and informational-to-critical scales. Beyond that, source-specific detail is preserved as tags rather than flattened into a schema that would lose it.

The sync runs hourly. Each source page shows when it was last checked and when its rules were last rebuilt, and those are tracked separately on purpose — an ingest that never reached upstream shouldn't look like a successful refresh.

How rules are classified

A classifier reads every rule and places it on a rung of David Bianco's Pyramid of Pain — atomic IOC, artifact, tool, or TTP — which orders indicators by what it costs an adversary to change the thing being matched. That rung is what separates "forty rules covering this technique" from "forty rotating filenames".

The verdict comes from the rule's own structure, and it is not a quality score: a rule keyed on a single domain isn't a worse rule, it is a different kind of thing. Where structure alone doesn't settle the question the rule is marked pending rather than guessed at, which is currently about a third of the index, and each one records which check declined. The tiers page walks through every rung.

Where the rules live

Upstream. This site indexes and links; it doesn't fork, rehost, or redistribute rulesets. Every rule links back to the exact file it came from, and every source page reproduces the license that project publishes under.

Where a project publishes no license at all, we index its rules by metadata and link to them, but don't reproduce the rule logic here. See the source list for which projects those are.

What it deliberately isn't

• Not a SIEM. It doesn't ingest logs, run detections, or raise alerts.
• Not an authoring tool. Rules aren't written or edited here.
• Not a marketplace. Scope is open-source and freely available rulesets only.
• Not a redistribution. The rules stay in their source repositories, and we link back.

On the numbers

We exclude deprecated rules and atomic-IOC rules from counts by default — the ones whose whole logic is a single domain, address or hash. There are tens of thousands of them, and left in they drown the behavioural rules most people are looking for. Where a page hides something, it says so and offers a toggle.

Quality and coverage figures are heuristics, not verdicts. A technique showing heavy coverage means many rules mention it, not that the technique is well detected in your environment.

Sources

Fifteen projects are tracked. We add sources deliberately rather than by open submission, because each one needs a parser written for its format and a license reviewed before its rules can be shown.

Contact

Everything comes to one address: contact@detections.org. Corrections to a rule's mapping, licensing questions, takedown requests, and suggestions for a source worth adding all belong there.

The privacy page sets out what the site records and what it does not.