Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects a high volume of Azure Key Vault secret reads or key decryption operations performed by a single caller identity from multiple source IP addresses within a one-hour window, which may indicate credential harvesting or unauthorized access.
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
Correlates a device code flow sign-in event with bulk file downloads from SharePoint or OneDrive by the same user account within a 1-hour window. This behavior can indicate potential account compromise or misuse where an adversary uses device code phishing to authenticate and subsequently exfiltrate sensitive files.
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects Python interpreter activity accessing multiple credential store categories (such as password managers, Discord, SSH keys, or Steam) in a short window on a single device, or specific stealer scripts associated with known file paths.
Detects authentication to the MFT platform where multi-factor was not initiated.
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
Detects PowerShell launched hidden and non-interactive with an insecure execution policy and Base64 decode-and-execute, or a script combining Base64 decode-and-execute with browser history collection and WMI shadow copy enumeration, as seen in the Midnight Blizzard (GTG-20006) stager.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects process handle on LSASS process with certain access mask
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Detects repeated authentication failures against the wireless controller. Wireless
authentication attacks require physical proximity, so unlike internet-facing
brute force this indicates somebody near the building — which changes the response
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-AIR-CT5508-K9' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 5
authentication attacks require physical proximity, so unlike internet-facing
brute force this indicates somebody near the building — which changes the response
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-AIR-CT5508-K9' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 5
Detects a burst of failed authentications against Zimbra. Internet-facing webmail is
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
Detects anomalous Kerberos ticket requests observed by ADAudit Plus. Service ticket
harvesting — one account requesting tickets for many services in quick succession —
is the precursor to offline cracking of service account credentials, and it is quiet
at the domain controller unless something is watching for the pattern.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='KERBEROS_AUTHENTICATION_TICKET_REQUESTED'
| duration 1h
| groupby user, domain
| select user, domain, count(*) as cnt
| having cnt > 20
harvesting — one account requesting tickets for many services in quick succession —
is the precursor to offline cracking of service account credentials, and it is quiet
at the domain controller unless something is watching for the pattern.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='KERBEROS_AUTHENTICATION_TICKET_REQUESTED'
| duration 1h
| groupby user, domain
| select user, domain, count(*) as cnt
| having cnt > 20
Detects multiple failed sign-in attempts against specific high-privilege break-glass accounts in Microsoft Entra ID within a 1-hour window.
Detects successful Azure Active Directory (Entra ID) sign-ins using the device code flow where the originating device is neither registered nor trusted (managed or compliant), which may indicate suspicious authentication attempts or token abuse.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Page 3 of 229