Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects repeated PHP memory exhaustion (OOM) errors combined with segmentation faults or session warnings within a short timeframe, which may indicate application instability, resource exhaustion attacks, or exploitation attempts.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects an inbound QUIC/UDP port 443 burst targeting a Bun process (bun.exe or bun) from external IP addresses, followed by the process going completely silent on the network within a short time window. This pattern correlates with potential exploitation or denial-of-service conditions involving network parsing anomalies.
Detects service state changes recorded by ePO. Protection services stopping and
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
Detects deletion of an account on the FortiWeb WAF. Removing administrators during
an intrusion denies the organisation control of its own protection at the moment it
most needs it, and it erases the record of entitlement alongside.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='FORTIWEB' and action='USER_DELETED'
| groupby targetuser, role
an intrusion denies the organisation control of its own protection at the moment it
most needs it, and it erases the record of entitlement alongside.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='FORTIWEB' and action='USER_DELETED'
| groupby targetuser, role
Detects clusters of unreachable-service and no-connector-available events. Where
these concentrate on one application they suggest the connector serving it has been
disrupted — which, during an intrusion, denies access to the application while the
outage is treated as an infrastructure problem rather than a security one.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('SERVICE_NOT_REACHABLE', 'NO_CONNECTOR_AVAILABLE')
| duration 15m
| groupby app, reason
| select app, reason, count(*) as cnt
| having cnt > 15
these concentrate on one application they suggest the connector serving it has been
disrupted — which, during an intrusion, denies access to the application while the
outage is treated as an infrastructure problem rather than a security one.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('SERVICE_NOT_REACHABLE', 'NO_CONNECTOR_AVAILABLE')
| duration 15m
| groupby app, reason
| select app, reason, count(*) as cnt
| having cnt > 15
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Detects when a large number of virtual machines are powered off by a single user or initiator within a short timeframe, which can be an indicator of malicious availability interruption or virtualization disruption (such as ransomware preparation).
Detects configuration changes on a Barracuda load balancer. Load balancer
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects an unusual rate of terminated connections at the BIG-IP. Mass termination
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
Detects a rise in redirected web requests through the gateway. Redirection can
indicate traffic being steered somewhere other than the user intended, whether by
policy change or by interference further along the path.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_REDIRECTED'
| duration 1h
| groupby srcip, domain, url, category
indicate traffic being steered somewhere other than the user intended, whether by
policy change or by interference further along the path.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_REDIRECTED'
| duration 1h
| groupby srcip, domain, url, category
Detects deletion of a role in Centrify for Windows. Removing a role can strip access
from legitimate administrators during an incident, and it also erases the record of
who was entitled to what — which complicates reconstructing the access position
afterwards.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='ROLE_DELETED'
| groupby user, role, targetuser, domain
from legitimate administrators during an incident, and it also erases the record of
who was entitled to what — which complicates reconstructing the access position
afterwards.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='ROLE_DELETED'
| groupby user, role, targetuser, domain
Detects a pattern of lease denials consistent with DHCP starvation, where an attacker
requests leases until the pool is empty so that legitimate devices cannot obtain an
address. It is typically a precursor to a rogue DHCP server taking over address
assignment and redirecting traffic.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED'
| duration 10m
| groupby macaddress
| select macaddress, count(*) as cnt
| having cnt > 20
requests leases until the pool is empty so that legitimate devices cannot obtain an
address. It is typically a precursor to a rogue DHCP server taking over address
assignment and redirecting traffic.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED'
| duration 10m
| groupby macaddress
| select macaddress, count(*) as cnt
| having cnt > 20
Detects deletion of a managed resource from the vault following privileged access to
it. Removing the resource destroys the record of which credentials existed and who
held them, which is both destructive and a way of covering the preceding access.
Treat the deletion as evidence tampering rather than as routine housekeeping unless
a decommissioning record exists.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='RESOURCE_DELETED'
| groupby user, targetuser, srcip, message
it. Removing the resource destroys the record of which credentials existed and who
held them, which is both destructive and a way of covering the preceding access.
Treat the deletion as evidence tampering rather than as routine housekeeping unless
a decommissioning record exists.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='RESOURCE_DELETED'
| groupby user, targetuser, srcip, message
Detects a single account deleting a large number of files on the NAS. On shared
storage this is either ransomware working through the share, a destructive insider,
or an attacker removing backups before encrypting the primary estate.
NAS appliances rarely carry endpoint agents, so their own logs are frequently the
only place this is visible.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='DELETED'
| duration 10m
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 50
storage this is either ransomware working through the share, a destructive insider,
or an attacker removing backups before encrypting the primary estate.
NAS appliances rarely carry endpoint agents, so their own logs are frequently the
only place this is visible.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='DELETED'
| duration 10m
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 50
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
Detects execution of the XMRig Monero cryptominer or a miner
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
Detects usage of vssadmin or wmic to delete Volume Shadow Copies
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
Detects a burst of user deactivations in a Slack workspace. Mass deactivation locks
colleagues out of the channel an organisation uses to coordinate its own incident
response, which is both disruptive in itself and a way of blinding the responders
while something else proceeds.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_DEACTIVATED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 5
colleagues out of the channel an organisation uses to coordinate its own incident
response, which is both disruptive in itself and a way of blinding the responders
while something else proceeds.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_DEACTIVATED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 5
Detects the Shai-Hulud supply chain attack dead-man's switch: a gh-token-monitor persistence component followed by a recursive forced deletion of the user home directory, or the presence of the specific kill-switch string in a command line.
Page 2 of 149