Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects process access requests to LSASS process with potentially suspicious access flags
Detects one account viewing many secrets in a short period. Normal privileged work
touches one or two; sweeping the vault is harvesting, and it is the single most
valuable action available to an attacker who reaches a PAM platform.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='VIEWED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(file)
| having distinct_count_col1 > 10
touches one or two; sweeping the vault is harvesting, and it is the single most
valuable action available to an attacker who reaches a PAM platform.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='VIEWED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(file)
| having distinct_count_col1 > 10
Detects one account retrieving an unusually high number of distinct privileged
credentials in a short window. Legitimate privileged work involves one or two
checkouts for a specific task; sweeping the vault is what an attacker does after
compromising a PAM operator account, to harvest as much as possible before the
access is noticed.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 10
credentials in a short window. Legitimate privileged work involves one or two
checkouts for a specific task; sweeping the vault is what an attacker does after
compromising a PAM operator account, to harvest as much as possible before the
access is noticed.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 10
Detects a change in authentication protocol for privileged database access brokered
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
Detects a privileged credential retrieved from the vault with no session following it.
Legitimate checkout is followed by work. Retrieval without use suggests the credential
was taken to be kept — staged for later, or exfiltrated for use outside the platform
where the vault cannot see it.
This is a slow-burn detection and deliberately so: it surfaces preparation rather
than action, which is where the response window is widest.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 24h
| groupby user, targetuser
Legitimate checkout is followed by work. Retrieval without use suggests the credential
was taken to be kept — staged for later, or exfiltrated for use outside the platform
where the vault cannot see it.
This is a slow-burn detection and deliberately so: it surfaces preparation rather
than action, which is where the response window is widest.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 24h
| groupby user, targetuser
Detects a privileged credential retrieved from the vault with no session following it.
Legitimate checkout is followed by work. Retrieval without use suggests the credential
was taken to be kept — staged for later, or exfiltrated for use outside the platform
where the vault cannot see it.
This is a slow-burn detection and deliberately so: it surfaces preparation rather
than action, which is where the response window is widest.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 24h
| groupby user, targetuser
Legitimate checkout is followed by work. Retrieval without use suggests the credential
was taken to be kept — staged for later, or exfiltrated for use outside the platform
where the vault cannot see it.
This is a slow-burn detection and deliberately so: it surfaces preparation rather
than action, which is where the response window is widest.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 24h
| groupby user, targetuser
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Define a baseline threshold for failed sign-ins due to Conditional Access failures
Detects instances where an OAuth token is used from a new IP address and a new country within 24 hours of a successful device-code sign-in for the same user, potentially indicating token theft or abuse.
Detects the Shai-Hulud tensorlake payload pattern of fetching a platform-specific HackBrowserData binary and then executing it on the same host to dump browser-stored credentials. Anchored on tool behavior (download then execution on one host) rather than a single sample hash or the rotating C2 domain.
Detects the execution of known credential theft tools such as Mimikatz, SharpDecryptPwd, and WebBrowserPassView via EDR process creation telemetry.
Detects processes accessing sensitive files and configurations associated with multiple AI coding assistants (such as Claude, Codex, Grok, and Cursor) within a short time window, potentially indicating unauthorized access or credential theft from AI tools.
Detects non-browser processes accessing multiple sensitive browser credential/cookie files or cryptocurrency wallet files within a 24-hour window, which is a common indicator of credential theft or information stealer activity.
The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches.
Detects successful OAuth device-code flow sign-ins where the user completed multi-factor authentication (MFA) from a non-compliant/unmanaged device using an IP address never seen in their 30-day baseline history. This behavior can indicate device-code phishing or token abuse.
Page 4 of 229