Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects the creation or modification of inbox rules in Exchange Online that target financial-related keywords and hide/delete mail, or rules that mark all incoming mail as read and delete them, which may indicate a Business Email Compromise (BEC) attack or mailbox evasion technique.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects modifications to Certificate Authority (CA) trust stores, configuration files, or blocklists on Linux and macOS endpoints, followed by trust store update commands within a 30-minute window.
Detects post-exploitation behavior where a PaperCut server Java process spawns local account creation or administrator reset followed closely by Active Directory enumeration on the same host, indicating potential post-RCE meterpreter activity.
Detects a sequence of security-sensitive events in GitHub repositories where branch protection rules are modified or removed, followed closely by a force push to the protected repository, and subsequent workflow activity involving the Berri-AI/litellm repository or similar context. This pattern often indicates malicious tampering with repository controls to introduce unauthorized code.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects successful administrative login events originating from IP addresses outside of configured trusted management networks on Fortinet devices.
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects execution of the Tailscale CLI enabling or disabling Tailscale SSH using the set or up commands with the --ssh parameter, excluding known administrative tools.
Detects a suspicious sequence of activities in GCP Compute Engine where a principal creates a new VM instance, attaches a disk, and creates a disk snapshot or new disk within a short window, potentially indicating data staging or exfiltration preparation.
Detects deletion or modification of Azure backup items, vaults, recovery points, VM snapshots, or soft-delete configurations within AzureActivity logs, which may indicate an adversary attempting to inhibit system recovery or cover tracks.
Detects the creation or renaming of the 'ESX Admins' Active Directory security group combined with the addition of members to it, which is often used for privilege escalation or persistence in VMware ESXi environments managed via Active Directory.
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects potential abuse of WordPress application passwords by correlating an authorization mint request (authorize-application.php) from an administrator's browser with a subsequent REST API page creation request to the same destination server from a different source IP address within a short time window.
This rule queries the ExposureGraphNodes table to identify and summarize assets that are configured as internet-facing or exposed to the internet.
Detects account deletion on the wireless controller. Removing administrators denies
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Page 1 of 143