Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,263 detections
Filters
Last updated
All Time
Detection languages
3,337
1,086
505
478
471
Contributors
1,824
1,622
874
505
300
Categories
3,026
2,538
1,074
1,047
927
Platforms
39,932
7,263
6,535
3,864
3,643
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,334
1,318
899
883
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects administrative login to the ePO console. An ePO administrator can change
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
Detects mail redirection on Zimbra Collaboration. Zimbra is widely deployed in
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
Detects a threat identified in Zimbra mail flow. Because Zimbra is both the mail
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
Detects service state changes recorded by ePO. Protection services stopping and
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
Detects a burst of failed authentications against Zimbra. Internet-facing webmail is
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
Detects extensive file access on the NAS from a source address without prior
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
Detects the Cisco AsyncOS content scanner / AMP service writing files into
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Page 11 of 346