Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Detects the presence of Cisco SD-WAN vManage software, vulnerabilities related to CVE-2026-76504, associated file artifacts, and process executions across endpoints using inventory and event logs.
Detects potential SQL injection (SQLi) attempts targeting web applications by identifying multiple requests matching specific SQLi regex patterns combined with encoding or internal reference markers within web access logs.
Detects a threat raised by the Cisco wireless LAN controller — rogue access points,
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects shell or interpreter processes spawned as children of the
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
Detects potential abuse of WordPress application passwords by correlating an authorization mint request (authorize-application.php) from an administrator's browser with a subsequent REST API page creation request to the same destination server from a different source IP address within a short time window.
Detects a burst of denied requests at the load balancer. The appliance sits in front
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
Detects a threat identified by Cisco Meraki. Meraki is the security stack for branch
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
Detects account deletion on the wireless controller. Removing administrators denies
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects VPN connection events where the client hostname contains the string 'kali', which may indicate the use of a penetration testing operating system or a suspicious device connecting to the corporate network via Palo Alto Networks GlobalProtect.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Finds BeyondTrust Remote Support (Bomgar) appliances at version 26.2.3 or earlier that have a public IP address, indicating a potentially internet-facing vulnerable appliance (CVE-2026-102764). Index and field names are placeholders to adapt.
Detects a substantial outbound transfer from a Meraki-protected site. Branch
locations have predictable, modest traffic profiles, which makes a sustained upload
unusually visible against that baseline compared with the same transfer leaving a
datacentre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
locations have predictable, modest traffic profiles, which makes a sustained upload
unusually visible against that baseline compared with the same transfer leaving a
datacentre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
Detects administrative login to the FortiWeb console from an address without prior
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
Detects connections held open far longer than normal. Interactive command and
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
Page 2 of 312