Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
Detects a role change in Zendesk. An administrator can read every ticket, export
data, alter automations and add agents — and support platforms are a favoured
target for social engineering precisely because agents are trained to be helpful to
strangers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_UPDATED'
| groupby user, targetuser, role
data, alter automations and add agents — and support platforms are a favoured
target for social engineering precisely because agents are trained to be helpful to
strangers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_UPDATED'
| groupby user, targetuser, role
Detects configuration changes on the MFT platform. Configuration governs who may
transfer what, to where, and whether it is logged — so a change can open an
exfiltration path or silence the record of one, and it persists until somebody
reviews the configuration again.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='GOANYWHERE-MFT'
and action='CONFIGURATION_CHANGED'
| groupby user, config
transfer what, to where, and whether it is logged — so a change can open an
exfiltration path or silence the record of one, and it persists until somebody
reviews the configuration again.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='GOANYWHERE-MFT'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects a role change on the Mimecast platform. A gateway administrator can read
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
Detects a user being invited into an Atlassian site. Invitation is the lowest-friction
route into a documentation estate: no exploit, no credential theft, simply an account
added by someone with the rights to do so.
Compare the invited domain against the organisation's own; an external domain
invitation outside a known partner arrangement warrants confirmation.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN'
and action in ('USER_INVITED', 'USER_REINVITED')
| groupby user, targetuser, domain, sitename
route into a documentation estate: no exploit, no credential theft, simply an account
added by someone with the rights to do so.
Compare the invited domain against the organisation's own; an external domain
invitation outside a known partner arrangement warrants confirmation.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN'
and action in ('USER_INVITED', 'USER_REINVITED')
| groupby user, targetuser, domain, sitename
Detects heartbeat and synchronisation events in Secret Server. Heartbeat verifies a
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects direct execution and testing of SAP Function Modules via SE37 test frame. This identifies correlation between a transaction start (AU7) and a function module call (BU4) in close succession
Detects when a user starts or interacts with the ABAP debugger on an SAP production system, which is a sensitive action that could indicate unauthorized debugging or privilege manipulation.
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects the creation of specific GitHub repositories ('tpcp-docs' or 'docs-tpcp') associated with TeamPCP stealer fallback exfiltration activity, including subsequent release or asset creation.
A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
This may indicate an attempt to change instance startup behavior or establish persistence.
These CloudTrail events do not confirm that the modified user-data script executed.
The following analytic detects the use of the Enable-PSRemoting cmdlet, which allows PowerShell remoting on a local or remote computer. This detection leverages PowerShell Script Block Logging (EventCode 4104) to identify when this cmdlet is executed. Monitoring this activity is crucial as it can indicate an attacker enabling remote command execution capabilities on a compromised system. If confirmed malicious, this activity could allow an attacker to take control of the system remotely, execute commands, and potentially pivot to other systems within the network, leading to further compromise and lateral movement.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes.
Page 4 of 144