Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects account deletion on the wireless controller. Removing administrators denies
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects configuration changes on the Zimbra server. Mail server configuration
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects configuration changes on the FortiWeb WAF. Disabling a signature, adding an
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects administrative login to the FortiWeb console from an address without prior
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
Detects repository creation or addition to an organisation. Attackers use new
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
M365 Malicious Mailbox Rule Abuse
Cortex XDR
Detects the creation or modification of Microsoft 365 Exchange inbox rules that exhibit characteristics of malicious behavior, such as using trivial or blank names, moving items to rarely-monitored folders (e.g., 'Conversation History', 'RSS Feeds'), or containing keywords related to phishing, credential harvesting, or financial fraud.
Detects commands executed on a Barracuda load balancer. Network appliances sit
outside most endpoint monitoring, so their own audit trail is frequently the only
record that anyone logged in and did something.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='BARRACUDA-LOADBALANCER' and action='SESSION_ENDED'
| groupby user, process, commandline
outside most endpoint monitoring, so their own audit trail is frequently the only
record that anyone logged in and did something.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='BARRACUDA-LOADBALANCER' and action='SESSION_ENDED'
| groupby user, process, commandline
Detects configuration changes to DLP policy. Weakening the policy — excluding a
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects a Slack workflow being published. Workflows run automation inside the
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
Detects a privileged command executed through Centrify on Windows. Brokered
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
Detects configuration changes on the Mimecast gateway. Mail gateway policy decides
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
Detects a Slack role change conferring administrative rights. A workspace admin can
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
Detects an invitation into a GitHub organisation. Membership confers access to
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
Detects configuration changes on the email inspector. Weakening sandbox analysis —
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects a privileged password change shortly after failed authentication attempts
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
Page 2 of 144