Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
505 detections
Filters
Last updated
All Time
Detection languages
245
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
210
138
110
80
76
Products / Services
147
74
61
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects when an SAP audit message ID appears in security audit logs but is absent from the defined monitoring configuration table, which could indicate attempts to bypass or disable monitoring controls.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
Detects configuration changes on the MFT platform. Configuration governs who may
transfer what, to where, and whether it is logged — so a change can open an
exfiltration path or silence the record of one, and it persists until somebody
reviews the configuration again.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='GOANYWHERE-MFT'
and action='CONFIGURATION_CHANGED'
| groupby user, config
transfer what, to where, and whether it is logged — so a change can open an
exfiltration path or silence the record of one, and it persists until somebody
reviews the configuration again.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='GOANYWHERE-MFT'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects deletion of a Jira issue security scheme. These schemes restrict who can see
sensitive issues — security findings, HR matters, incident records. Removing one can
expose restricted issues to the whole project at a stroke, and it is a quiet way to
gain access to material that was deliberately walled off.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=jira-project where sourcename='ATLASSIAN'
and action='SECURITY_SCHEME_DELETED'
| groupby user, project, issuesecurityscheme, permissionscheme
sensitive issues — security findings, HR matters, incident records. Removing one can
expose restricted issues to the whole project at a stroke, and it is a quiet way to
gain access to material that was deliberately walled off.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=jira-project where sourcename='ATLASSIAN'
and action='SECURITY_SCHEME_DELETED'
| groupby user, project, issuesecurityscheme, permissionscheme
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes.
A Build Work Zone site was created or its content was modified
The SAP FTP server allowlist was empty or populated with wildcard entries
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
This rule detects the installation of browser extensions that request highly sensitive, over-broad permissions such as proxy configuration management and web authentication provider access, combined with full host access (<all_urls>). This pattern is often indicative of malicious extensions masquerading as legitimate tools (e.g., VPNs) to facilitate credential theft or traffic interception.
The following analytic detects the addition of new IIS modules on a Windows IIS server. It leverages the Windows Event log - Microsoft-IIS-Configuration/Operational, specifically EventCode 29, to identify this activity. This behavior is significant because IIS modules are rarely added to production servers, and unauthorized modules could indicate malicious activity. If confirmed malicious, an attacker could use these modules to execute arbitrary code, escalate privileges, or maintain persistence within the environment, potentially compromising the server and sensitive data.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Page 2 of 25