Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects five or more Entra ID device registrations by a single account where device names match microsoft-* or WINDOWS-* patterns, occurring shortly after a device code flow sign-in by the same account. This behavior is indicative of device registration abuse or persistent access attempts.
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Correlates a device code flow sign-in event with bulk file downloads from SharePoint or OneDrive by the same user account within a 1-hour window. This behavior can indicate potential account compromise or misuse where an adversary uses device code phishing to authenticate and subsequently exfiltrate sensitive files.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
Detects repository creation or addition to an organisation. Attackers use new
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
M365 Malicious Mailbox Rule Abuse
Cortex XDR
Detects the creation or modification of Microsoft 365 Exchange inbox rules that exhibit characteristics of malicious behavior, such as using trivial or blank names, moving items to rarely-monitored folders (e.g., 'Conversation History', 'RSS Feeds'), or containing keywords related to phishing, credential harvesting, or financial fraud.
Detects a new agent account in Zendesk. An agent can read customer conversations and
correspond with customers under the organisation's name — which makes an
unauthorised agent account both a data exposure and a channel for defrauding the
organisation's own customers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_ADDED'
| groupby user, targetuser, role
correspond with customers under the organisation's name — which makes an
unauthorised agent account both a data exposure and a channel for defrauding the
organisation's own customers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_ADDED'
| groupby user, targetuser, role
Detects deletion of content within Zendesk. Removing attachments or tickets destroys
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
the record of a support interaction, which is how a social engineering attempt that
succeeded gets erased before anyone reviews how the attacker obtained what they did.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=documents where sourcename='ZENDESK' and action='DELETED'
| groupby user, file, srcip, visibility
Detects an export from Zendesk. Support platforms accumulate exactly what an
attacker wants for the next stage — customer names, contact details, account
references, and the content of conversations in which people routinely paste
things they should not. An export takes all of it at once.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=ticket-requested where sourcename='ZENDESK' and action='EXPORTED'
| groupby user, srcip, sourceclassification, sourcelabel
attacker wants for the next stage — customer names, contact details, account
references, and the content of conversations in which people routinely paste
things they should not. An export takes all of it at once.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=ticket-requested where sourcename='ZENDESK' and action='EXPORTED'
| groupby user, srcip, sourceclassification, sourcelabel
Detects a Slack workflow being published. Workflows run automation inside the
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
Detects configuration changes on the Mimecast gateway. Mail gateway policy decides
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
Detects a Slack role change conferring administrative rights. A workspace admin can
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
Detects an invitation into a GitHub organisation. Membership confers access to
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
Detects an account joining the workspace. Slack Connect and guest access let outside
identities into an internal communication space, and an unexpected join is how an
attacker gains a listening position without touching the network perimeter at all.
Check the account type: a guest or external identity joining a channel carrying
operational or security discussion is worth immediate confirmation with the inviter.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_JOINED_WORKSPACE'
| groupby user, targetuser, accounttype, workspace
identities into an internal communication space, and an unexpected join is how an
attacker gains a listening position without touching the network perimeter at all.
Check the account type: a guest or external identity joining a channel carrying
operational or security discussion is worth immediate confirmation with the inviter.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_JOINED_WORKSPACE'
| groupby user, targetuser, accounttype, workspace
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
Page 2 of 142