Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects repeated authentication failures at the IBM Security Access Manager reverse
proxy. WebSEAL fronts internal applications for external users, so it is the first
thing an attacker reaches and frequently the only control between the internet and
a legacy application that has none of its own.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ISAM-WEBSEAL' and action='LOGIN'
| duration 15m
| groupby srcip, status, reason
| select srcip, status, reason, distinct_count(user)
| having distinct_count_col1 > 8
proxy. WebSEAL fronts internal applications for external users, so it is the first
thing an attacker reaches and frequently the only control between the internet and
a legacy application that has none of its own.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ISAM-WEBSEAL' and action='LOGIN'
| duration 15m
| groupby srcip, status, reason
| select srcip, status, reason, distinct_count(user)
| having distinct_count_col1 > 8
Detects repeated network policy access denials. NPS governs RADIUS-based access to
VPN and wireless, so a burst of denials for one identity is credential testing
against the remote access perimeter — often the first move against an organisation
from outside.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='NPS_USER_DENIED'
| duration 15m
| groupby user, networkpolicyname, reasoncode
| select user, networkpolicyname, reasoncode, count(*) as cnt
| having cnt > 10
VPN and wireless, so a burst of denials for one identity is credential testing
against the remote access perimeter — often the first move against an organisation
from outside.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='NPS_USER_DENIED'
| duration 15m
| groupby user, networkpolicyname, reasoncode
| select user, networkpolicyname, reasoncode, count(*) as cnt
| having cnt > 10
Detects Kerberos service ticket requests observed in network traffic analysis.
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
Detects a secret being revealed in the Secret Server interface. Launching a session
uses a credential without exposing it; displaying it puts the plaintext in front of
a human, where it can be copied, photographed or written down and used outside every
control the vault provides.
Display is materially more serious than use, and the two are worth separating.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action='PASSWORD_DISPLAYED'
| groupby user, file, filetype, srcip
uses a credential without exposing it; displaying it puts the plaintext in front of
a human, where it can be copied, photographed or written down and used outside every
control the vault provides.
Display is materially more serious than use, and the two are worth separating.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action='PASSWORD_DISPLAYED'
| groupby user, file, filetype, srcip
Detects use of a credential seeded by the deception platform. Decoy credentials are
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
Detects retrieval of a privileged credential from the PAM360 vault outside normal
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
This rule detects suspicious activity related to input capturing, keylogging, or credential access, specifically looking for corresponding 'ActionType' events in Microsoft Defender for Endpoint (DeviceEvents) logs. It alerts on processes performing these actions on devices.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes
(EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user
to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
(EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user
to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.
Azure AD Device Code Flow Token Phishing
Cortex XDR
Detects potential device code phishing attacks by identifying OAuth token requests associated with the device code flow that originate from unmanaged or non-compliant devices. The rule specifically monitors for suspicious Cmsi (Client Managed Service Identity) activity or the use of unbound sign-in tokens within the device code flow for targeted Microsoft productivity and management applications.
The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.
The following analytic detects non-Firefox processes accessing the Firefox profile directory, which contains sensitive user data such as login credentials, browsing history, and cookies. It leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant because it may indicate attempts by malware, such as RATs or trojans, to harvest user information. If confirmed malicious, this behavior could lead to data exfiltration, unauthorized access to user accounts, and further compromise of the affected system.
The following analytic detects attempts to read LSASS memory, indicative of credential dumping.
It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
The following analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. The detection method uses Endpoint Detection and Response (EDR) telemetry to identify when fodhelper.exe spawns a child process and accesses the registry keys. This activity is significant because it indicates a potential privilege escalation attempt by an attacker. If confirmed malicious, the attacker could execute commands with elevated privileges, leading to unauthorized system changes and potential full system compromise.
A SPNEGO authentication token was replayed against an SAP system
Detects failed internal SAP logon attempts (AU2) targeting an invalid or non-existent client, indicating potential misconfiguration or an unauthorized access probe.
Detects creation of files or folders under the hard-coded staging
directory C:\Users\Public\Temp\ChromeAuto_. Astaroth's spambot
copies the victim's browser "User Data" profile directory to this path so it can
spawn a fresh browser instance carrying the victim's active WhatsApp Web session
cookies and stored browser credentials, bypassing authentication entirely.
directory C:\Users\Public\Temp\ChromeAuto_. Astaroth's spambot
copies the victim's browser "User Data" profile directory to this path so it can
spawn a fresh browser instance carrying the victim's active WhatsApp Web session
cookies and stored browser credentials, bypassing authentication entirely.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces.
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).
The following analytic identifies the creation of a program executable in an unquoted service path, a common technique for privilege escalation. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is 'services.exe'. This activity is significant because unquoted service paths can be exploited by attackers to execute arbitrary code with elevated privileges. If confirmed malicious, this could allow an attacker to gain higher-level access, potentially leading to full system compromise and persistent control over the affected endpoint.
Page 4 of 206