Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects authentication to the Barracuda load balancer management interface. Appliance
management accounts are often shared, rarely rotated and seldom covered by the
identity controls applied elsewhere, which makes them a durable route back in.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='BARRACUDA-LOADBALANCER' and action='LOGIN'
| groupby user, srcip, authproto
management accounts are often shared, rarely rotated and seldom covered by the
identity controls applied elsewhere, which makes them a durable route back in.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='BARRACUDA-LOADBALANCER' and action='LOGIN'
| groupby user, srcip, authproto
Detects repeated authentication failures against the wireless controller. Wireless
authentication attacks require physical proximity, so unlike internet-facing
brute force this indicates somebody near the building — which changes the response
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-AIR-CT5508-K9' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 5
authentication attacks require physical proximity, so unlike internet-facing
brute force this indicates somebody near the building — which changes the response
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-AIR-CT5508-K9' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 5
Detects account creation on the wireless controller. Network infrastructure accounts
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
Detects algorithmically generated domain names at the resolver. Malware families
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
Detects one endpoint authenticating under several distinct user identities in a short
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
Detects a host generating an unusual rate of failed DNS resolutions. A high NXDOMAIN
rate is the signature of a client searching for something that mostly does not exist
— DGA malware hunting for its live controller, or tooling enumerating subdomains.
This complements the DGA detection: entropy catches the shape of the names, NXDOMAIN
rate catches the behaviour regardless of how the names look.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(responsecode) like '%nxdomain%'
| duration 10m
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 50
rate is the signature of a client searching for something that mostly does not exist
— DGA malware hunting for its live controller, or tooling enumerating subdomains.
This complements the DGA detection: entropy catches the shape of the names, NXDOMAIN
rate catches the behaviour regardless of how the names look.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(responsecode) like '%nxdomain%'
| duration 10m
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 50
Detects potential data exfiltration to popular public paste-sites and code-sharing services (such as Pastebin, Paste.ee, Hastebin, Ghostbin, ControlC, Dpaste, Rentry.co, Privatebin) using HTTP POST or PUT requests based on upload frequency and volume thresholds.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Page 3 of 312