Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Detects the creation or renaming of the 'ESX Admins' Active Directory security group combined with the addition of members to it, which is often used for privilege escalation or persistence in VMware ESXi environments managed via Active Directory.
Detects five or more Entra ID device registrations by a single account where device names match microsoft-* or WINDOWS-* patterns, occurring shortly after a device code flow sign-in by the same account. This behavior is indicative of device registration abuse or persistent access attempts.
Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
Detects a Slack role change conferring administrative rights. A workspace admin can
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
Detects a privileged password change shortly after failed authentication attempts
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects a role being added in Centrify for Linux. Roles determine which servers an
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
Detects creation of an Atlassian API token. Tokens authenticate without a password
and without multi-factor, and they persist until revoked — which makes token creation
one of the most durable persistence mechanisms available on a SaaS platform holding
an organisation's project and documentation estate.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='API_TOKEN_CREATED'
| groupby user, targetuser, sitename, domain
and without multi-factor, and they persist until revoked — which makes token creation
one of the most durable persistence mechanisms available on a SaaS platform holding
an organisation's project and documentation estate.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='API_TOKEN_CREATED'
| groupby user, targetuser, sitename, domain
Detects a privilege change within an Atlassian site. Confluence and Jira hold
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
Detects modification of user account attributes in Active Directory. Attribute
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
Detects a role modification shortly after failed authentication attempts for the same
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
Page 1 of 40