Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,393 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,689
1,317
905
813
744
Platforms
5,922
913
883
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects a privilege change recorded by Centrify on a Linux server. Centrify brokers
privileged access to Unix estates, so it sees elevation decisions that native auditd
may record only partially — and in many estates it is the only consistent record
across heterogeneous Linux and AIX systems.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX'
and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, domain
privileged access to Unix estates, so it sees elevation decisions that native auditd
may record only partially — and in many estates it is the only consistent record
across heterogeneous Linux and AIX systems.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX'
and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, domain
Detects heartbeat and synchronisation events in Secret Server. Heartbeat verifies a
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
Detects an account being unlocked through Centrify on Windows. Lockout is often the
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
Detects scheduled task creation observed through ADAudit Plus. Scheduled tasks are a
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
Detects use of a credential seeded by the deception platform. Decoy credentials are
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
Detects retrieval of a privileged credential from the PAM360 vault outside normal
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
Detects Sysmon registry events (EventCode 12, 13, 14) writing Run/RunOnce keys or Service ImagePath values that reference esetservice.exe from a user-writable path (AppData, ProgramData, Temp, Public, Downloads), excluding the legitimate Program Files\ESET install location.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
Detects creation of sitecustomize.py, usercustomize.py, or .pth path configuration files inside a site-packages or dist-packages directory by a python or pip process. These files are automatically loaded by Python's site module on every subsequent interpreter start, allowing a malicious package installer to establish persistence that re-executes on every future Python invocation without further victim interaction.
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects scenarios where a user's password is reset or sessions are revoked in Azure Active Directory, followed closely by mailbox access (items accessed, sent, or deleted) from a client IP address that was never seen interacting with that mailbox prior to the password reset event.
An account was unlocked and then authenticated from the same IP as the account that unlocked it
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Page 8 of 400