Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
406
57
14
12
12
Contributors
387
54
19
13
12
Categories
146
108
66
45
35
Platforms
396
33
19
18
13
Products / Services
205
137
62
40
31
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
Detects a web request bypassing SafeSquid filtering policy. The extractor exposes
BYPASSED as a distinct action, which is unusual and valuable — most gateways record
only allow or block, so a bypass is normally indistinguishable from an allow.
A bypass means policy was deliberately not applied to that request, and the question
is who arranged that.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='BYPASSED'
| groupby srcip, user, domain, url, category
BYPASSED as a distinct action, which is unusual and valuable — most gateways record
only allow or block, so a bypass is normally indistinguishable from an allow.
A bypass means policy was deliberately not applied to that request, and the question
is who arranged that.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='BYPASSED'
| groupby srcip, user, domain, url, category
Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
Detects configuration changes to DLP policy. Weakening the policy — excluding a
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects configuration changes on the Mimecast gateway. Mail gateway policy decides
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
Detects configuration changes on the email inspector. Weakening sandbox analysis —
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall
Detects Java processes spawning PowerShell or Command Prompt to modify Windows Defender settings by adding exclusions for sensitive paths or extensions (such as AppData, Temp, Users Public, or ProgramData).
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts
Detects the Cisco AsyncOS content scanner / AMP service writing files into
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL.
Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
Detects configuration changes on the SafeSquid gateway. Adding a bypass or relaxing
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects quarantined messages being released at volume. Release overrides the
gateway's own verdict, so a burst of releases either reflects a false positive wave
or an attacker with administrative access letting their own delivery through the
control that stopped it.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MIMECAST' and action='EMAIL_QUARANTINED'
| duration 1h
| groupby sender, recipient, direction
gateway's own verdict, so a burst of releases either reflects a false positive wave
or an attacker with administrative access letting their own delivery through the
control that stopped it.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MIMECAST' and action='EMAIL_QUARANTINED'
| duration 1h
| groupby sender, recipient, direction
Detects a successful network admission following repeated posture compliance
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
Detects modification of ISE configuration governing who may join the network and
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
Detects a change in authentication protocol for privileged database access brokered
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
Detects configuration changes to Oracle Audit Vault. The Vault is the integrity
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Detects a sequence of events indicative of Bring Your Own Vulnerable Driver (BYOVD) attacks or security control impairment. It monitors for the loading of a rare driver (seen on 3 or fewer hosts), accompanied by either the creation of a kernel service or defense tampering activities such as disabling security monitoring or stopping security-related services.
Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
Page 2 of 24