Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
The following analytic detects the disabling of security jobs in CircleCI pipelines. It leverages CircleCI log data, renaming and extracting fields such as job names, workflow IDs, user information, commit messages, URLs, and branches. The detection identifies mandatory jobs for each workflow and checks if they were executed. This activity is significant because disabling security jobs can allow malicious code to bypass security checks, leading to potential data breaches, system downtime, and reputational damage. If confirmed malicious, this could result in unauthorized code execution and compromised pipeline integrity.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects a Slack login from a source address without prior history for that account.
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
Detects creation of a GitHub Actions workflow. A workflow executes code on runners
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
Detects creation of an Atlassian API token. Tokens authenticate without a password
and without multi-factor, and they persist until revoked — which makes token creation
one of the most durable persistence mechanisms available on a SaaS platform holding
an organisation's project and documentation estate.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='API_TOKEN_CREATED'
| groupby user, targetuser, sitename, domain
and without multi-factor, and they persist until revoked — which makes token creation
one of the most durable persistence mechanisms available on a SaaS platform holding
an organisation's project and documentation estate.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='API_TOKEN_CREATED'
| groupby user, targetuser, sitename, domain
Detects a privilege change within an Atlassian site. Confluence and Jira hold
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
architecture documentation, runbooks, credentials pasted into tickets and project
plans — so a privilege escalation here is a documentation-estate compromise, which
typically precedes a far more targeted attack elsewhere.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED'
| groupby user, targetuser, role, group, sitename
Detects export of the Atlassian audit log. An export hands over the full record of
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
Detects repositories being downloaded. Source code is intellectual property and
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
Detects a pattern of previewing many files then downloading a subset. This is
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
Detects a single Box account downloading an unusually high number of distinct files
in a short window. This is the clearest signal of data theft from cloud storage,
whether by a departing employee or an attacker using a compromised account.
Baseline per role before deployment: sales and legal teams legitimately pull large
document sets, while most users download a handful of files a day.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='DOWNLOADED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 50
in a short window. This is the clearest signal of data theft from cloud storage,
whether by a departing employee or an attacker using a compromised account.
Baseline per role before deployment: sales and legal teams legitimately pull large
document sets, while most users download a handful of files a day.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='DOWNLOADED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 50
Detects a Box file or folder being made publicly accessible. Public sharing turns an
internal document into an internet-reachable URL, and is both a common accidental
data exposure and a deliberate low-friction exfiltration route that generates no
outbound traffic from the corporate network.
The Visibility field carries the change, which makes this directly detectable rather
than inferred.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX'
and lower(visibility) like '%public%'
| groupby user, file, visibility, srcip
internal document into an internet-reachable URL, and is both a common accidental
data exposure and a deliberate low-friction exfiltration route that generates no
outbound traffic from the corporate network.
The Visibility field carries the change, which makes this directly detectable rather
than inferred.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX'
and lower(visibility) like '%public%'
| groupby user, file, visibility, srcip
Detects a Box account accessed from a source address with no prior history, followed
by substantial download activity. The combination is far stronger than either signal
alone: a new location by itself is routine for mobile users, and downloads by
themselves are routine for everyone.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='DOWNLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 25
by substantial download activity. The combination is far stronger than either signal
alone: a new location by itself is routine for mobile users, and downloads by
themselves are routine for everyone.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='DOWNLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 25
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects and monitors sign-in events for specific high-privilege or sensitive accounts, such as break-glass accounts, within Microsoft Entra ID.
Page 3 of 142