Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,598 detections
Filters
Last updated
All Time
Detection languages
1,151
134
65
63
53
Contributors
368
274
239
197
70
Categories
983
375
271
227
140
Platforms
871
506
164
160
149
Products / Services
949
298
133
113
108
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
1,598
CVEs
2
1
1
1
1
IDS Classtypes
18
5
4
1
1
IDS Protocols
15
8
4
3
Detects an inbound email flood attack (many distinct senders to a single recipient within a 5-minute window) followed by an external Microsoft Teams message sent to the same user, typically associated with IT support pretexting or callback phishing attacks.
Identifies devices that have communicated with domains present in the OpenPhish public phishing feed by comparing domains observed in DeviceNetworkEvents.RemoteUrl against domains extracted from the current OpenPhish feed.
Detects Microsoft Teams chat creation events originating from an external sender whose user ID or display name impersonates IT support (e.g., IT Support, Help Desk, Service Desk), often used in social engineering or phishing attempts.
Detects external Microsoft Teams messages containing support-related social engineering lures or originating from known malicious/IOC tenant domains, summarizing sender and thread metrics. The query ran without errors in a live tenant.
Detects correlation between an external Microsoft Teams chat creation and the subsequent launch of a remote access or monitoring (RMM) tool on the same user's device within a 30-minute window, which is indicative of potential social engineering or tech support scam initial access campaigns.
Detects a potential multi-stage social engineering attack where a user first receives a high volume of emails (mail-bomb burst) within a short window, followed shortly by an external Microsoft Teams message from a suspicious throwaway tenant using an IT help desk display name.
Detects a potential social engineering or phishing attack pattern where a recipient first receives a high volume of inbound emails (mail flood) within a short window, followed quickly by an external Microsoft Teams chat message from an IT-themed sender attempting to impersonate internal support.
Detects a web browser spawning a script interpreter or dual-use
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
Detects inbound emails impersonating OpenCode breach notices that urge API key rotation and contain links to non-OpenCode domains.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects incoming xAI invitation emails from noreply@x.ai containing URLs that do not belong to the x.ai domain, which may indicate a phishing attempt or link injection.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects inbound mail carrying an attachment from a sending server not previously
seen. Most legitimate correspondence arrives from infrastructure with history;
first-contact plus attachment is the shape of a targeted delivery attempt.
Pair with the recipient list: a single first-seen sender reaching many recipients at
once is a campaign rather than a one-off.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_RECEIVED' and file != ''
| groupby remoteip, sender, file, recipient
seen. Most legitimate correspondence arrives from infrastructure with history;
first-contact plus attachment is the shape of a targeted delivery attempt.
Pair with the recipient list: a single first-seen sender reaching many recipients at
once is a campaign rather than a one-off.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_RECEIVED' and file != ''
| groupby remoteip, sender, file, recipient
Users who received a delivered phishing email and then signed in from an IP not seen for them in the prior 30 days within 24 hours. Hunting query, not an alert.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects a threat identified in Zimbra mail flow. Because Zimbra is both the mail
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
Detects a threat identified by Deep Discovery Email Inspector. DDEI detonates
attachments and inspects URLs in a sandbox, so its verdicts carry behavioural
evidence rather than signature matches — which makes them a strong input for
detections that most estates never ingest.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TREND-MICRO-DDEI' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, threattype, srcip
attachments and inspects URLs in a sandbox, so its verdicts carry behavioural
evidence rather than signature matches — which makes them a strong input for
detections that most estates never ingest.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TREND-MICRO-DDEI' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, threattype, srcip
Detects threats identified by Mimecast where the same sender appears repeatedly.
A single blocked message is routine; the same origin returning again and again is a
campaign specifically targeting this organisation, and the repetition is the signal
worth acting on rather than the individual block.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=threat where sourcename='MIMECAST' and action='THREAT_DETECTED'
| duration 24h
| groupby sender, srcip
| select sender, srcip, distinct_count(recipient)
| having distinct_count_col1 > 5
A single blocked message is routine; the same origin returning again and again is a
campaign specifically targeting this organisation, and the repetition is the signal
worth acting on rather than the individual block.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=threat where sourcename='MIMECAST' and action='THREAT_DETECTED'
| duration 24h
| groupby sender, srcip
| select sender, srcip, distinct_count(recipient)
| having distinct_count_col1 > 5
Detects incoming xAI invitation emails from noreply@x.ai containing URLs that do not belong to the x.ai domain, which may indicate a phishing attempt or link injection.
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Page 1 of 77