Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects configuration changes to the PAM platform itself. Vault configuration governs
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
Detects a role change in Zendesk. An administrator can read every ticket, export
data, alter automations and add agents — and support platforms are a favoured
target for social engineering precisely because agents are trained to be helpful to
strangers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_UPDATED'
| groupby user, targetuser, role
data, alter automations and add agents — and support platforms are a favoured
target for social engineering precisely because agents are trained to be helpful to
strangers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_UPDATED'
| groupby user, targetuser, role
Detects a role change on the Mimecast platform. A gateway administrator can read
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
Detects modification of a monitored file on a Centrify-managed Linux host. File
integrity events on Unix servers catch tampering with configuration, authorised keys
and service definitions — the common Linux persistence routes, which leave no
registry trace and no Windows-style artefact.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='FILE_MODIFIED'
| groupby user, targetuser, domain
integrity events on Unix servers catch tampering with configuration, authorised keys
and service definitions — the common Linux persistence routes, which leave no
registry trace and no Windows-style artefact.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='FILE_MODIFIED'
| groupby user, targetuser, domain
Detects a privilege change recorded by Centrify on a Linux server. Centrify brokers
privileged access to Unix estates, so it sees elevation decisions that native auditd
may record only partially — and in many estates it is the only consistent record
across heterogeneous Linux and AIX systems.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX'
and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, domain
privileged access to Unix estates, so it sees elevation decisions that native auditd
may record only partially — and in many estates it is the only consistent record
across heterogeneous Linux and AIX systems.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX'
and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, domain
Detects heartbeat and synchronisation events in Secret Server. Heartbeat verifies a
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
Detects an account being unlocked through Centrify on Windows. Lockout is often the
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects scenarios where a user's password is reset or sessions are revoked in Azure Active Directory, followed closely by mailbox access (items accessed, sent, or deleted) from a client IP address that was never seen interacting with that mailbox prior to the password reset event.
An account was unlocked and then authenticated from the same IP as the account that unlocked it
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
The following analytic detects attempts to reset the Directory Services Restore Mode (DSRM) administrator password on a Domain Controller. It leverages event code 4794 from the Windows Security Event Log, specifically looking for events where the DSRM password reset is attempted. This activity is significant because the DSRM account can be used similarly to a local administrator account, providing potential persistence for an attacker. If confirmed malicious, this could allow an attacker to maintain administrative access to the Domain Controller, posing a severe risk to the domain's security.
This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
A user was added to a BTP role collection carrying subaccount, directory, or global account administrator rights
Detects when a privileged SAP user's credentials are reset by an administrator and subsequently used to log in from the same IP address that the administrator previously used.
Detects when a privileged SAP account modifies the master record of a different user within a specified timeframe.
Detects modifications to privileged SAP accounts' user master records or authorizations, indicating potential account manipulation or privilege abuse.
Detects the modification of a user's master record via an administrative action within SAP, which may indicate unauthorized account manipulation or privilege escalation.
Page 2 of 40