Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,582 detections
Filters
Last updated
All Time
Detection languages
5,138
3,901
1,034
828
476
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,444
1,825
1,661
1,578
1,416
Platforms
8,040
1,888
1,334
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
Detects successful Azure Active Directory (Entra ID) sign-ins using the device code flow where the originating device is neither registered nor trusted (managed or compliant), which may indicate suspicious authentication attempts or token abuse.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects the creation of a new Windows service (EventCode 7045) where the service binary path (ImagePath) points to the ProgramData directory, with exclusions for known legitimate paths such as Windows Defender, Package Cache, and Chocolatey.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Detects a role being added in Centrify for Linux. Roles determine which servers an
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
Detects a threat raised by Zscaler Private Access. Because ZPA mediates every
connection to an internal application, a threat on a session means hostile activity
reaching private applications from a device that already passed authentication —
which points at the endpoint rather than the perimeter.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=threat where sourcename='ZSCALER-SPA' and action='THREAT_DETECTED'
| groupby user, srcip, threat
connection to an internal application, a threat on a session means hostile activity
reaching private applications from a device that already passed authentication —
which points at the endpoint rather than the perimeter.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=threat where sourcename='ZSCALER-SPA' and action='THREAT_DETECTED'
| groupby user, srcip, threat
Detects a Slack login from a source address without prior history for that account.
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
Detects creation of a GitHub Actions workflow. A workflow executes code on runners
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
Detects a privileged session launched from Secret Server. The launch is the moment
privileged access begins, and it carries the identity, the target and the source
address together — a cleaner attribution point than anything the target system will
record about a shared administrative account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='LAUNCHED'
| groupby user, file, filetype, srcip
privileged access begins, and it carries the identity, the target and the source
address together — a cleaner attribution point than anything the target system will
record about a shared administrative account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='LAUNCHED'
| groupby user, file, filetype, srcip
Detects creation of an Atlassian API token. Tokens authenticate without a password
and without multi-factor, and they persist until revoked — which makes token creation
one of the most durable persistence mechanisms available on a SaaS platform holding
an organisation's project and documentation estate.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='API_TOKEN_CREATED'
| groupby user, targetuser, sitename, domain
and without multi-factor, and they persist until revoked — which makes token creation
one of the most durable persistence mechanisms available on a SaaS platform holding
an organisation's project and documentation estate.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='API_TOKEN_CREATED'
| groupby user, targetuser, sitename, domain
Detects a privilege change within an Atlassian site. Confluence and Jira hold
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
Detects modification of user account attributes in Active Directory. Attribute
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
Detects an endpoint or identity moving from a guest role to a corporate one. Guest
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
Detects a role modification shortly after failed authentication attempts for the same
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
Detects creation of a database user observed by Guardium. Database-level accounts
frequently sit outside enterprise identity governance, which makes them attractive
persistence: an account created directly in the database survives directory cleanup
and is rarely reviewed.
Onboarding: IBM-GUARDIUM is ingested via Syslog (KV) (Bloo extractor 282).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='IBM-GUARDIUM' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
frequently sit outside enterprise identity governance, which makes them attractive
persistence: an account created directly in the database survives directory cleanup
and is rarely reviewed.
Onboarding: IBM-GUARDIUM is ingested via Syslog (KV) (Bloo extractor 282).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='IBM-GUARDIUM' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
Detects a change in authentication protocol for privileged database access brokered
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
Detects a privileged account authenticating to destinations outside its established
pattern. Privileged accounts are usually scoped to a defined estate — a database
admin reaches databases, not workstations. Appearance outside that scope is lateral
movement using legitimate credentials, which endpoint tooling will not flag.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CYBERARK' and action='LOGIN'
| groupby user, dstip, srcip, authproto
pattern. Privileged accounts are usually scoped to a defined estate — a database
admin reaches databases, not workstations. Appearance outside that scope is lateral
movement using legitimate credentials, which endpoint tooling will not flag.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CYBERARK' and action='LOGIN'
| groupby user, dstip, srcip, authproto
Detects use of a vaulted privileged credential from a source address with no prior
history for that account. Privileged accounts operate from a narrow and stable set of
jump hosts; a new origin means either an undocumented access path or an attacker
operating the credential from their own foothold.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_USED'
| groupby user, targetuser, srcip, role
history for that account. Privileged accounts operate from a narrow and stable set of
jump hosts; a new origin means either an undocumented access path or an attacker
operating the credential from their own foothold.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_USED'
| groupby user, targetuser, srcip, role
Detects any authentication attempt against a Smokescreen decoy asset. Decoys are not
published in directories, hold no business function and are never referenced by
legitimate automation, so an authentication attempt is attacker activity by definition
rather than something requiring interpretation.
This is the highest-signal, lowest-noise detection available on any log source: there
is no benign path to a decoy login.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='SMOKESCREEN' and action='LOGIN'
| groupby user, srcip, authproto
published in directories, hold no business function and are never referenced by
legitimate automation, so an authentication attempt is attacker activity by definition
rather than something requiring interpretation.
This is the highest-signal, lowest-noise detection available on any log source: there
is no benign path to a decoy login.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='SMOKESCREEN' and action='LOGIN'
| groupby user, srcip, authproto
Detects a privileged database login brokered through Arcon ARCOS from a source
address without prior history. ARCOS sits in front of database administrative access,
so it observes privileged DB sessions that database-native auditing often misses
entirely.
The extractor exposes a deliberately narrow field set — user, source address and
authentication protocol — so this detection is intentionally simple.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby user, srcip, authproto
address without prior history. ARCOS sits in front of database administrative access,
so it observes privileged DB sessions that database-native auditing often misses
entirely.
The extractor exposes a deliberately narrow field set — user, source address and
authentication protocol — so this detection is intentionally simple.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby user, srcip, authproto
Detects configuration changes to the PAM platform itself. Vault configuration governs
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
Page 8 of 600