Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,061 detections
Filters
Last updated
All Time
Detection languages
594
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,872
5,155
4,866
1,061
Platforms
576
267
228
221
116
Products / Services
499
220
129
118
86
MITRE Techniques
487
451
362
349
339
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects Microsoft 365 token replay from the Huntress token spray and replay campaign. Alerts on sign-ins from an IP new to the account (not seen on 3 or more distinct days in the 14d baseline) that match one of three behaviors: a scripted client (node or bare Mozilla/5.0 user agent with Office or Authentication Broker client IDs), Device Registration Service access (Medium-High only when corroborated by a campaign IP, scripted user agent or session IP hop, otherwise Low), or one session moving across IPs within 60 minutes. Rows are raised to High when the same new IP hits 3 or more baseline accounts in the window (token spray pattern) or matches a campaign IOC. Low Signal rows are dropped when AlertOnly = true. Does not cover MFA changes, device registration events or inbox rules.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects authentication to the MFT platform where multi-factor was not initiated.
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Detects a Slack login from a source address without prior history for that account.
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
Detects and monitors sign-in events for specific high-privilege or sensitive accounts, such as break-glass accounts, within Microsoft Entra ID.
Detects RADIUS authentication activity observed in network traffic, including the
MAC address of the requesting device. Seeing RADIUS on the wire catches
authentication against network infrastructure that often logs nowhere else —
switches, wireless controllers and VPN concentrators.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-radius where sourcename='NTA'
| duration 1h
| groupby srcip, dstip, user, macaddress
MAC address of the requesting device. Seeing RADIUS on the wire catches
authentication against network infrastructure that often logs nowhere else —
switches, wireless controllers and VPN concentrators.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-radius where sourcename='NTA'
| duration 1h
| groupby srcip, dstip, user, macaddress
Detects VNC and remote framebuffer sessions, including the authentication method
negotiated. RFB is frequently deployed without strong authentication on industrial
and legacy systems, and an attacker finding one has interactive desktop access to a
machine that often cannot run an endpoint agent at all.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-rfb where sourcename='NTA'
| groupby srcip, dstip, dstport, authmethod
negotiated. RFB is frequently deployed without strong authentication on industrial
and legacy systems, and an attacker finding one has interactive desktop access to a
machine that often cannot run an endpoint agent at all.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-rfb where sourcename='NTA'
| groupby srcip, dstip, dstport, authmethod
Detects a change in authentication protocol for privileged database access brokered
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
Detects any authentication attempt against a Smokescreen decoy asset. Decoys are not
published in directories, hold no business function and are never referenced by
legitimate automation, so an authentication attempt is attacker activity by definition
rather than something requiring interpretation.
This is the highest-signal, lowest-noise detection available on any log source: there
is no benign path to a decoy login.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='SMOKESCREEN' and action='LOGIN'
| groupby user, srcip, authproto
published in directories, hold no business function and are never referenced by
legitimate automation, so an authentication attempt is attacker activity by definition
rather than something requiring interpretation.
This is the highest-signal, lowest-noise detection available on any log source: there
is no benign path to a decoy login.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='SMOKESCREEN' and action='LOGIN'
| groupby user, srcip, authproto
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Azure AD Device Code Flow Token Phishing
Cortex XDR
Detects potential device code phishing attacks by identifying OAuth token requests associated with the device code flow that originate from unmanaged or non-compliant devices. The rule specifically monitors for suspicious Cmsi (Client Managed Service Identity) activity or the use of unbound sign-in tokens within the device code flow for targeted Microsoft productivity and management applications.
Detects potential AiTM or credential harvesting campaigns where a device visits known lure or redirect paths (such as specific domains or workers.dev paths) and subsequently accesses the Microsoft device code authentication page within a 15-minute window.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
A SPNEGO authentication token was replayed against an SAP system
Detects repeated OAuth device authorization ('device code') grant flow authentication events targeting the same user within a short window, which is indicative of an active device code phishing attempt.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Unsigned LDAP Bind
Cortex XDR
Detects Lightweight Directory Access Protocol (LDAP) binds that are performed without signing or encryption. Attack tools such as NetExec, ldapdomaindump, and Impacket frequently use simple, unencrypted LDAP binds over port 389, which can result in the transmission of credentials in cleartext. This rule monitors Windows Event ID 2889 on Domain Controllers, which logs cleartext LDAP bind attempts.
Detects Microsoft Entra ID (formerly Azure AD) sign-in attempts that use the specific, hardcoded User-Agent string associated with the TeamFiltration tool. This tool is frequently used for mass credential testing against Microsoft 365 environments. The detection looks for a suspicious and outdated combination of Teams, Electron, and Chrome versions that would not be present in legitimate, modern Microsoft Teams client traffic.
Page 1 of 51