Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects one internal host repeatedly triggering DNS threat blocks. A single block is
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
Detects DNS tunnelling, where data is encoded into queries and answers against a
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
Detects a DHCP-driven DNS update for a hostname not present in the asset inventory.
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
This rule performs an IOC sweep over the past 30 days using DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to detect indicators associated with PoeLLM / Canto Incognito malware campaigns, specifically scanning for known C2 IP addresses, Kryptex cryptomining pool endpoints/domains, and specific file hashes (SHA256).
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
Correlates ARTEX tool artifacts on a device with that device contacting the ARTEX host, xcai.pro, or the DeepSeek API within 24 hours.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Page 3 of 60