Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,116 detections
Filters
Last updated
All Time
Detection languages
6,549
6,199
1,473
1,002
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,567
3,899
1,465
1,391
1,330
Platforms
13,722
1,392
1,318
824
738
Products / Services
3,828
3,129
2,448
912
908
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects the WinLol Rust dropper staging a DLL sideload by writing a copy of Microsoft OneDrive.exe and a proxy version.dll into a user temp directory by a non-OneDrive, non-installer process.
Detects PowerShell execution involving Base64 decoding or certutil decoding combined with writing files to the AppData directory using .NET I/O methods or PowerShell cmdlets.
Users who received a delivered phishing email and then signed in from an IP not seen for them in the prior 30 days within 24 hours. Hunting query, not an alert.
Detects service principal sign-ins involving known compromised application IDs associated with the ConnectWise cloud backup and management supply-chain attack.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Detects administrative login to the ePO console. An ePO administrator can change
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
Detects deletion of content within Zendesk. Removing attachments or tickets destroys
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
Detects authentication to the Barracuda load balancer management interface. Appliance
management accounts are often shared, rarely rotated and seldom covered by the
identity controls applied elsewhere, which makes them a durable route back in.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='BARRACUDA-LOADBALANCER' and action='LOGIN'
| groupby user, srcip, authproto
management accounts are often shared, rarely rotated and seldom covered by the
identity controls applied elsewhere, which makes them a durable route back in.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='BARRACUDA-LOADBALANCER' and action='LOGIN'
| groupby user, srcip, authproto
Detects MFT authentication from a source address without prior history. Transfer
platforms are reached by a small, stable set of partners and internal systems, so
the population of legitimate source addresses is unusually predictable — which makes
a new one unusually meaningful.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| duration 24h
| groupby srcip, user, authproto
platforms are reached by a small, stable set of partners and internal systems, so
the population of legitimate source addresses is unusually predictable — which makes
a new one unusually meaningful.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| duration 24h
| groupby srcip, user, authproto
Detects a privileged session beginning with no preceding credential retrieval by the
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
Detects one endpoint authenticating under several distinct user identities in a short
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
Detects the Cisco AsyncOS content scanner / AMP service writing files into
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
Detects mshta.exe executing a remote HTA payload over HTTP/HTTPS, the initial fileless execution stage of ACR Stealer's Campaign 2. The retrieved HTA contains VBScript loaders that ultimately deploy obfuscated PowerShell and steganography-assisted in-memory shellcode.
Detects a renamed PSF-signed pythonw.exe (with an original file name of pythonw.exe but a different on-disk name) launched from a user-writable path under Users. The command line consists only of its own path, which is consistent with ._pth based path configuration abuse for loading attacker code stealthily.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Builds a per-account baseline of the devices that each enabled service account has made a successful network logon to over the previous 30 days, then alerts when one makes a successful network logon to a device outside that baseline within the latest window.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Page 5 of 863