Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,439
11,829
5,873
5,151
4,864
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Detects a source generating blocked packets across many ports at a Meraki site.
Scanning between branch sites never traverses the core firewall, so without the
branch appliance's own logs this activity is invisible from the centre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Scanning between branch sites never traverses the core firewall, so without the
branch appliance's own logs this activity is invisible from the centre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
This rule detects a classic port knocking sequence followed by a connection to sensitive services (SSH, Telnet, RDP, VNC, WinRM). The rule identifies devices performing rapid connections to multiple different ports within a short window, which is indicative of a port knocking attempt used to trigger service exposure, followed by an immediate attempt to connect to that exposed service.
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.
Detects anomalous, high-frequency outbound connection attempts from a NetScaler appliance to internal network hosts. This pattern is indicative of potential post-exploitation lateral movement or internal network scanning by the SLAPSHOT malware (associated with CVE-2026-88772), as an appliance typically should not engage in rapid internal fan-out behavior.
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
This rule monitors network device logs for patterns indicative of reconnaissance or vulnerability scanning against management and VPN interfaces of common firewall and network appliances (FortiGate, Meraki, WatchGuard, Sophos). It flags sources that either request multiple sensitive paths related to system status and configuration or employ known scanning tools (Nmap, masscan, Nuclei, zgrab, curl) in the user-agent string.
Page 2 of 32