Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Detects the Blinder Tunnel C2 loop. The loader beacons about every 63 seconds to the GitHub Contents API (profile upload, one-time license read). The newer variant can instead go through a Cloudflare Workers relay that mirrors the GitHub API paths. Both platforms are legitimate, so the signal is the client: the implant install directory, a non-System32 RuntimeBroker.exe, or any binary under AppData\Local\Microsoft\, none of which are real GitHub clients. Known implant hosts and the known relay alert on a single hit. The lookalike-path arm needs 10 or more connections per hour (a 63-second loop produces 100+), which suppresses incidental noise. Depends on RemoteUrl being populated for TLS connections.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities.
It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios.
Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.
It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios.
Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects historical network connections, URL clicks, browser launches, email URLs, and process command lines associated with Wazza phishkit infrastructure IOCs including boegl-krysl.eu, coppietersrecherche.eu, and beacon-surge-sync.workers.dev.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects VNC and remote framebuffer sessions, including the authentication method
negotiated. RFB is frequently deployed without strong authentication on industrial
and legacy systems, and an attacker finding one has interactive desktop access to a
machine that often cannot run an endpoint agent at all.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-rfb where sourcename='NTA'
| groupby srcip, dstip, dstport, authmethod
negotiated. RFB is frequently deployed without strong authentication on industrial
and legacy systems, and an attacker finding one has interactive desktop access to a
machine that often cannot run an endpoint agent at all.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-rfb where sourcename='NTA'
| groupby srcip, dstip, dstport, authmethod
Detects a DHCP-driven DNS update for a hostname not present in the asset inventory.
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Page 5 of 246