Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
782 detections
Filters
Last updated
All Time
Detection languages
431
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,439
11,829
5,873
5,151
4,864
782
Platforms
340
223
141
138
71
Products / Services
319
167
85
57
50
MITRE Techniques
413
348
255
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
Detects an Active Directory password spray attack originating from a single source IP, followed closely by a user account creation event (Event ID 4720) associated with a logon from that same source IP.
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Detects a high volume of authentication failures followed by a successful authentication from the same source IP address against edge devices like FortiGate or Palo Alto GlobalProtect within a specific time window.
Detects password spraying activity against Azure Active Directory / Microsoft 365 services where a single source IP attempts to authenticate against numerous distinct user accounts with low attempt counts per account and sustained over time, while excluding successful authentication IPs.
Detects Microsoft Entra ID sign-ins to specific third-party applications related to Updraft (TeamUpdraft, UpdraftCentral, UpdraftVault, UpdraftClone, UpdraftPlus) with anomalous characteristics such as multi-IP access, distinct countries, or failed-then-successful access attempts, indicating possible credential compromise or misuse.
Detects password spraying: a single source IP generating failed
logins against many distinct accounts in a short window. AI-assisted planning
can produce low-rate credential attacks designed to stay under per-account
lockout thresholds; the distinguishing signal is breadth across users rather
than volume per user.
logins against many distinct accounts in a short window. AI-assisted planning
can produce low-rate credential attacks designed to stay under per-account
lockout thresholds; the distinguishing signal is breadth across users rather
than volume per user.
Detects multiple distinct source IPs sending forged 'pitboss PPE' authentication failure messages to NetScaler authentication endpoints within a short timeframe, associated with a fetch-based FreeBSD payload download (kw2-freebsd-x64-s11).
Detects potential password spraying behavior in Entra ID sign-in logs, characterized by a single source IP attempting authentication against numerous distinct user accounts with a low number of attempts per user.
Detects potential Multi-Factor Authentication (MFA) fatigue or push bombing attacks against Azure Active Directory (Entra ID) accounts by identifying a high volume of MFA failures followed by suspicious or fraudulent report actions, or successful authentications shortly after repeated failures.
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Detects password spraying activity against Azure Active Directory / Microsoft 365 services where a single source IP attempts to authenticate against numerous distinct user accounts with low attempt counts per account and sustained over time, while excluding successful authentication IPs.
Detects repeated authentication failures against the wireless controller. Wireless
authentication attacks require physical proximity, so unlike internet-facing
brute force this indicates somebody near the building — which changes the response
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-AIR-CT5508-K9' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 5
authentication attacks require physical proximity, so unlike internet-facing
brute force this indicates somebody near the building — which changes the response
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-AIR-CT5508-K9' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 5
Detects a burst of failed authentications against Zimbra. Internet-facing webmail is
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
Detects multiple failed sign-in attempts against specific high-privilege break-glass accounts in Microsoft Entra ID within a 1-hour window.
Define a baseline threshold for failed sign-ins due to Conditional Access failures
Identifies brute force attacks on SAP systems using RFC logons. Detects a single IP attempting to sign in to several systems or clients within a 1-hour interval, indicating potential credential stuffing or internal lateral movement.
Detects repeated authentication failures at the IBM Security Access Manager reverse
proxy. WebSEAL fronts internal applications for external users, so it is the first
thing an attacker reaches and frequently the only control between the internet and
a legacy application that has none of its own.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ISAM-WEBSEAL' and action='LOGIN'
| duration 15m
| groupby srcip, status, reason
| select srcip, status, reason, distinct_count(user)
| having distinct_count_col1 > 8
proxy. WebSEAL fronts internal applications for external users, so it is the first
thing an attacker reaches and frequently the only control between the internet and
a legacy application that has none of its own.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ISAM-WEBSEAL' and action='LOGIN'
| duration 15m
| groupby srcip, status, reason
| select srcip, status, reason, distinct_count(user)
| having distinct_count_col1 > 8
Detects repeated network policy access denials. NPS governs RADIUS-based access to
VPN and wireless, so a burst of denials for one identity is credential testing
against the remote access perimeter — often the first move against an organisation
from outside.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='NPS_USER_DENIED'
| duration 15m
| groupby user, networkpolicyname, reasoncode
| select user, networkpolicyname, reasoncode, count(*) as cnt
| having cnt > 10
VPN and wireless, so a burst of denials for one identity is credential testing
against the remote access perimeter — often the first move against an organisation
from outside.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='NPS_USER_DENIED'
| duration 15m
| groupby user, networkpolicyname, reasoncode
| select user, networkpolicyname, reasoncode, count(*) as cnt
| having cnt > 10
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects failed internal SAP logon attempts (AU2) targeting an invalid or non-existent client, indicating potential misconfiguration or an unauthorized access probe.
Detects successful or failed logon activity by a privileged SAP account on a production system using SAP Security Audit logs.
Page 1 of 38