Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects repeated PHP memory exhaustion (OOM) errors combined with segmentation faults or session warnings within a short timeframe, which may indicate application instability, resource exhaustion attacks, or exploitation attempts.
Detects a mail bombing pattern where a recipient receives a burst of inbound emails from many distinct senders within a short time window, followed by a Microsoft Teams message or chat creation from the same user context shortly after.
Detects a sequence where a process is launched from or references the hidden /tmp/.x directory (indicative of cryptominer deployment), followed within 30 minutes on the same device by a process-check command (such as ps, top, or htop) referencing XMRig or /tmp/.x.
Detects behavioral indicators of shell-driven cryptocurrency miner staging where a hidden .trace file or binary is created, executed, or referenced via command-line arguments within go2rtc or shared memory directories (/config/, /opt/go2rtc/, /etc/go2rtc/, /.config/go2rtc/, /dev/shm/), alongside indicators of mining pools or software such as XMRig.
Detects a burst of file modifications producing common
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects attempts to inhibit system recovery by stopping the Volume Shadow Copy Service (VSS) using utilities like net, net1, or sc, or deleting shadow copies using vssadmin.exe, excluding known backup agents.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
The following analytic detects the use of the taskkill command in a process command line to terminate several known browser processes, a technique commonly employed by the Braodo stealer malware to steal credentials. By forcefully closing browsers like Chrome, Edge, and Firefox, the malware can unlock files that store sensitive information, such as passwords and login data. This detection focuses on identifying taskkill commands targeting these browsers, signaling malicious intent. Early detection allows security teams to investigate and prevent further credential theft and system compromise.
Detects deletion or modification of Azure backup items, vaults, recovery points, VM snapshots, or soft-delete configurations within AzureActivity logs, which may indicate an adversary attempting to inhibit system recovery or cover tracks.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects the execution of built-in Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit performing recovery inhibition actions, including deleting volume shadow copies, resizing shadow storage, clearing the backup catalog, disabling recovery options, and configuring boot policies to ignore failures.
Detects shadow copy destruction and recovery feature tampering used
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
Detects service-initiated processes using cryptocurrency mining algorithms, pool configurations, or miner-specific execution parameters.
Detects inbound UDP traffic on port 443 (QUIC) targeting known HTTP/3-capable server processes (such as Caddy, Traefik, Cloudflared) followed closely by the termination or crash of that process, which may indicate an exploit attempt or vulnerability leading to denial of service.
Detects account deletion on the wireless controller. Removing administrators denies
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
Page 1 of 149