Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects a source generating blocked packets across many destination ports. Branch
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Detects access to directory service objects. Bulk reads of directory objects are how
an attacker maps the domain — users, groups, trusts, service principals — before
deciding what to target. It is read-only activity, which means nothing breaks and
nothing else is likely to alert.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='DIRECTORY_SERVICE_ACCESSED'
| duration 1h
| groupby user, objectclass, objecttype, domain
an attacker maps the domain — users, groups, trusts, service principals — before
deciding what to target. It is read-only activity, which means nothing breaks and
nothing else is likely to alert.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='DIRECTORY_SERVICE_ACCESSED'
| duration 1h
| groupby user, objectclass, objecttype, domain
Detects a pattern of previewing many files then downloading a subset. This is
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects PowerShell processes spawned by common managed file transfer (MFT) or web service processes (such as Serv-U, GoAnywhere, MOVEit, Cleo, Tomcat, etc.) performing remote system discovery or ingress tool transfer activities.
Detects queries checking for specific Windows hotfixes (QFE) using the WindowsQfe table.
The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators.
While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution.
Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection.
Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators.
While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution.
Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection.
Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay.
Detects when a single AWS user identity or IP address enumerates multiple resources across different AWS services (such as SQS, Lambda, ECS, CodeDeploy, S3, RDS, Athena) within a short time window, indicating potential reconnaissance or discovery activity.
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
Detects a source generating blocked packets across many ports at a Meraki site.
Scanning between branch sites never traverses the core firewall, so without the
branch appliance's own logs this activity is invisible from the centre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Scanning between branch sites never traverses the core firewall, so without the
branch appliance's own logs this activity is invisible from the centre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Detects access to files hosted on a decoy share. Decoy shares carry inviting names and
plausible content but hold nothing real and are linked from nowhere, so a file open is
deliberate discovery rather than a user stumbling into the wrong folder.
Which file was opened is itself intelligence: it indicates what the intruder is
looking for, and that shapes where you look next in the real estate.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and file != ''
| groupby file, user, srcip
plausible content but hold nothing real and are linked from nowhere, so a file open is
deliberate discovery rather than a user stumbling into the wrong folder.
Which file was opened is itself intelligence: it indicates what the intruder is
looking for, and that shapes where you look next in the real estate.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and file != ''
| groupby file, user, srcip
Detects when a device connects to a wireless network SSID that has not been observed in the baseline over the previous 14 days.
Detects the use of vim and its siblings commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or breaking out from restricted environments.
Detects the use of system utilities (wevtutil, PowerShell, wmic, etc.) or log-reading tools (grep, tail) for log enumeration or export when executed by processes that are not standard management or monitoring agents. This pattern is commonly associated with adversary efforts to gain situational awareness or identify security logs.
The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities.
This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications.
While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network.
If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment.
This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications.
While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network.
If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detect adversaries enumerate sensitive files
The following analytic detects the execution of the `Get-WMIObject Win32_Group` command using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, allowing for detailed analysis. Identifying group information on an endpoint is not inherently malicious but can be suspicious based on context such as time, endpoint, and user. This activity is significant as it may indicate reconnaissance efforts by an attacker. If confirmed malicious, it could lead to further enumeration and potential lateral movement within the network.
The following analytic detects the execution of the Windows OS tool quser.exe, commonly used to gather information about user sessions on a Remote Desktop Session Host server. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as quser.exe is often abused by post-exploitation tools like winpeas, used in ransomware attacks to enumerate user sessions. If confirmed malicious, attackers could leverage this information to further compromise the system, maintain persistence, or escalate privileges.
The following analytic detects the execution of `net.exe` with command-line arguments used to query elevated domain or sensitive groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within Active Directory. If confirmed malicious, this behavior could lead to further attacks aimed at compromising privileged accounts, escalating privileges, or gaining unauthorized access to sensitive systems and data.
Page 3 of 203