Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,439
11,829
5,873
5,151
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects the addition of Microsoft Defender exclusions targeting the C:\Windows directory or SystemHealth\Update paths via PowerShell commands (Add-MpPreference/Set-MpPreference) or direct Registry modifications, which may indicate an attempt to evade security detection.
Detects a sequence of security-sensitive events in GitHub repositories where branch protection rules are modified or removed, followed closely by a force push to the protected repository, and subsequent workflow activity involving the Berri-AI/litellm repository or similar context. This pattern often indicates malicious tampering with repository controls to introduce unauthorized code.
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects configuration changes on the FortiWeb WAF. Disabling a signature, adding an
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
Detects configuration changes to DLP policy. Weakening the policy — excluding a
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects configuration changes on the Mimecast gateway. Mail gateway policy decides
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
Detects configuration changes on the email inspector. Weakening sandbox analysis —
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects configuration changes on the SafeSquid gateway. Adding a bypass or relaxing
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects a privilege change within an Atlassian site. Confluence and Jira hold
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
Detects deletion of a role in Centrify for Windows. Removing a role can strip access
from legitimate administrators during an incident, and it also erases the record of
who was entitled to what — which complicates reconstructing the access position
afterwards.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='ROLE_DELETED'
| groupby user, role, targetuser, domain
from legitimate administrators during an incident, and it also erases the record of
who was entitled to what — which complicates reconstructing the access position
afterwards.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='ROLE_DELETED'
| groupby user, role, targetuser, domain
Detects an endpoint or identity moving from a guest role to a corporate one. Guest
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
Detects modification of ISE configuration governing who may join the network and
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
Detects configuration changes to Oracle Audit Vault. The Vault is the integrity
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
Detects configuration changes to the PAM platform itself. Vault configuration governs
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
Page 1 of 42