Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects a threat identified by Cisco Meraki. Meraki is the security stack for branch
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
Detects outbound network connections to domains associated with the AdFection / Discover-Tech / Controlium threat infrastructure using a Sentinel watchlist, filtering out known browser activity or allowing custom domain lists.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects connections held open far longer than normal. Interactive command and
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects persistent blocked web requests from one internal source. A person stops
after a block; software does not. Sustained retries after blocking indicate
automation attempting to reach a destination it has been configured to use.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user, category
| select srcip, user, category, count(*) as cnt
| having cnt > 25
after a block; software does not. Sustained retries after blocking indicate
automation attempting to reach a destination it has been configured to use.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user, category
| select srcip, user, category, count(*) as cnt
| having cnt > 25
Detects web access through Meraki content filtering. Branch users frequently work
without the endpoint controls applied at headquarters, so the network appliance is
often the only layer observing where they go.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='CISCO-MERAKI' and action='URL_ACCESSED'
| duration 1h
| groupby srcip, domain, url, useragent, user
without the endpoint controls applied at headquarters, so the network appliance is
often the only layer observing where they go.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='CISCO-MERAKI' and action='URL_ACCESSED'
| duration 1h
| groupby srcip, domain, url, useragent, user
Detects one internal source repeatedly blocked from reaching URLs. Persistent
attempts after a block indicate automated software rather than a person — a person
gives up, malware retries on a timer.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='VERSA-NETWORKS' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user
| select srcip, user, count(*) as cnt
| having cnt > 20
attempts after a block indicate automated software rather than a person — a person
gives up, malware retries on a timer.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='VERSA-NETWORKS' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user
| select srcip, user, count(*) as cnt
| having cnt > 20
Detects a threat raised by Versa Networks on a zero trust session. Versa sits at the
branch edge, so it observes traffic from sites that frequently have no local
security stack at all — in many estates it is the only sensor between a remote
office and the internet.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='VERSA-NETWORKS' and action='THREAT_DETECTED'
| groupby user, srcip, dstip, threat, process
branch edge, so it observes traffic from sites that frequently have no local
security stack at all — in many estates it is the only sensor between a remote
office and the internet.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='VERSA-NETWORKS' and action='THREAT_DETECTED'
| groupby user, srcip, dstip, threat, process
Detects a decoy asset initiating an outbound connection. A decoy should only ever
receive traffic. Outbound activity means the asset has been compromised and is being
used as a launch point, or that attacker tooling on it is calling home.
The destination is live command-and-control infrastructure and should be blocked
estate-wide immediately rather than only on the decoy.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and dstip != ''
| groupby dstip, url, process, srcip
receive traffic. Outbound activity means the asset has been compromised and is being
used as a launch point, or that attacker tooling on it is calling home.
The destination is live command-and-control infrastructure and should be blocked
estate-wide immediately rather than only on the decoy.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and dstip != ''
| groupby dstip, url, process, srcip
Page 2 of 60