Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Identifies devices running Request Tracker (RT) applications, processes, files, or network services, and flags instances with vulnerable versions or specific CVEs (CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44229, CVE-2026-44230, CVE-2026-44231) below version 5.0.10.
Detects a sequence of AWS API calls where an external IP first calls sts:GetCallerIdentity, followed by Bedrock model listing APIs, and subsequently IAM or account/trail discovery events within a short timeframe, indicating potential cloud reconnaissance or unauthorized access.
Detects outbound network connections to known ClickFix campaign domains or the execution of the finger utility connecting to public IP addresses.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a sequence where an assumed-role credential from an external IP calls sts:GetCallerIdentity followed by listing Amazon Bedrock foundation models within a one-hour window, potentially indicating reconnaissance of AI/ML services by an external threat actor.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Detects the execution of tools and commands commonly used to enumerate Group Policy Objects (GPOs) within an environment, such as gpresult.exe with specific flags, PowerShell scripts querying GPO modules, or ldifde.exe checking group policy containers.
Detects web server processes (such as nginx, apache2, httpd, uwsgi, gunicorn, php-fpm) spawning command-line utilities typically used for system and user discovery (such as id, whoami, groups, hostname, uname, netstat, ps, etc.), which often indicates web application exploitation and remote code execution.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects repeated blocked access requests through Zscaler Private Access. ZPA brokers
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
Detects potential cloud storage object discovery activity in Azure Blob Storage by identifying anomalous listing or enumeration operations from callers, including high request counts, extensive container access, high failure rates, or anonymous authentication.
Detects clients reaching for ports that are unreachable or not permitted. A client
repeatedly attempting wrong ports against brokered applications is enumerating what
the broker will allow, which is reconnaissance conducted entirely inside an
authenticated zero trust session.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('CLIENT_WRONG_PORT', 'PORT_UNREACHABLE')
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(dstport)
| having distinct_count_col1 > 10
repeatedly attempting wrong ports against brokered applications is enumerating what
the broker will allow, which is reconnaissance conducted entirely inside an
authenticated zero trust session.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('CLIENT_WRONG_PORT', 'PORT_UNREACHABLE')
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(dstport)
| having distinct_count_col1 > 10
Detects processes that make outbound API calls to known Large Language Model (LLM) domains while simultaneously performing high-volume network connection attempts or scanning-like fan-out activity across multiple public IP addresses.
Detects potential debugger detection evasion attempts via command line arguments associated with debugging checks or process execution of debugging utilities, as well as persistence configuration using Image File Execution Options (IFEO) or AeDebug registry keys targeting debuggers.
Detects when the IIS worker process (w3wp.exe) spawns common system and network discovery utilities such as whoami, ipconfig, systeminfo, net, and others, which may indicate web shell activity or post-exploitation discovery.
Detects enumeration of local or remote network services.
Detects a source repeatedly denied by WebSEAL authorisation. Denials indicate
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
Page 2 of 203