Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
The following analytic detects the execution of known remote access software within the environment.
It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains.
It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services.
While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads.
This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain.
It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services.
While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads.
This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Detects an unusual rate of terminated connections at the BIG-IP. Mass termination
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
Detects web access through Meraki content filtering. Branch users frequently work
without the endpoint controls applied at headquarters, so the network appliance is
often the only layer observing where they go.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='CISCO-MERAKI' and action='URL_ACCESSED'
| duration 1h
| groupby srcip, domain, url, useragent, user
without the endpoint controls applied at headquarters, so the network appliance is
often the only layer observing where they go.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='CISCO-MERAKI' and action='URL_ACCESSED'
| duration 1h
| groupby srcip, domain, url, useragent, user
Detects one internal source repeatedly blocked from reaching URLs. Persistent
attempts after a block indicate automated software rather than a person — a person
gives up, malware retries on a timer.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='VERSA-NETWORKS' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user
| select srcip, user, count(*) as cnt
| having cnt > 20
attempts after a block indicate automated software rather than a person — a person
gives up, malware retries on a timer.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='VERSA-NETWORKS' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user
| select srcip, user, count(*) as cnt
| having cnt > 20
Detects a source generating blocked packets across many destination ports. Branch
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Detects a threat raised by Versa Networks on a zero trust session. Versa sits at the
branch edge, so it observes traffic from sites that frequently have no local
security stack at all — in many estates it is the only sensor between a remote
office and the internet.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='VERSA-NETWORKS' and action='THREAT_DETECTED'
| groupby user, srcip, dstip, threat, process
branch edge, so it observes traffic from sites that frequently have no local
security stack at all — in many estates it is the only sensor between a remote
office and the internet.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='VERSA-NETWORKS' and action='THREAT_DETECTED'
| groupby user, srcip, dstip, threat, process
Detects an endpoint or identity moving from a guest role to a corporate one. Guest
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
Detects a successful network admission following repeated posture compliance
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
Detects a role modification shortly after failed authentication attempts for the same
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
Detects one internal host repeatedly triggering DNS threat blocks. A single block is
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
Suspicious Connection to Custom GPT
Cortex XDR
Detects outbound web traffic to OpenAI ChatGPT Custom GPTs where the URL slug contains keywords potentially indicative of unauthorized or non-standard usage, such as keywords implying premium, professional, or official status, which could be used as a cover for data exfiltration or credential gathering via malicious or typo-squatted GPT instances.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Page 4 of 312