Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,394 detections
Filters
Last updated
All Time
Detection languages
3,122
2,716
779
497
379
Contributors
1,502
1,474
1,085
844
516
Categories
2,691
1,312
905
813
739
Platforms
5,927
913
878
299
280
Products / Services
1,620
1,401
1,084
454
419
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.
Detects when the same initiating process stops or deletes Windows services and subsequently deletes scheduled tasks or WMI event subscriptions within a 15-minute window on a single device, potentially indicating defense evasion or clean-up actions.
Detects Azure AD service principal sign-ins utilizing suspicious scripting-related user agents such as curl, python-requests, Wget, or Postman, which may indicate automated scripting, custom tooling, or potential abuse of cloud service accounts.
Detects new client secrets or certificates added to any service principal in Azure AD, specifically identifying activities linked to the ConnectWise supply-chain attack or suspicious user agents.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Detects AppInit DLL registry modifications referencing DLLs located in user-writable directories (such as AppData, Temp, Users\Public, or Downloads), which may indicate adversary persistence or process injection configuration.
Detects a sequence where a FortiSIEM-related process writes or modifies a shell script in a cron or phoenix directory, followed closely within 2 minutes by a child process spawned by cron executing that same written script file.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Detects persistence mechanisms established via Registry Run/RunOnce keys, Startup folder modifications, or scheduled task creation using specific tool names such as client32 or pcictlui.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
This rule detects suspicious driver loading from user-writable paths, kernel driver service creation, disabling of driver signing, loading of Linux kernel modules, and the usage of LD_PRELOAD for rootkit functionality.
Detects a user account that performs a device code sign-in flow followed by the registration of five or more devices with deceptive names (matching patterns like microsoft- or windows-) within a one day timeframe. This behavior can indicate an adversary establishing persistence or attempting tenant resource exhaustion using compromised accounts.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects administrative login to the FortiWeb console from an address without prior
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
Detects successful non-interactive sign-ins by Entra ID service principals from an IP address and location never seen in the prior 14 days, helping to identify potentially compromised application credentials used from unfamiliar locations.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
Users who received a delivered phishing email and then signed in from an IP not seen for them in the prior 30 days within 24 hours. Hunting query, not an alert.
Page 4 of 400