Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects and monitors sign-in events for specific high-privilege or sensitive accounts, such as break-glass accounts, within Microsoft Entra ID.
Detects instances where an OAuth token is used from a new IP address and a new country within 24 hours of a successful device-code sign-in for the same user, potentially indicating token theft or abuse.
Detects successful Google Workspace logins from an IP address or user agent not previously seen for the user within a 24-hour window.
Detects successful OAuth device-code flow sign-ins where the user completed multi-factor authentication (MFA) from a non-compliant/unmanaged device using an IP address never seen in their 30-day baseline history. This behavior can indicate device-code phishing or token abuse.
Detects authentication to the BIG-IP management interface. These interfaces should
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
Detects a successful network admission following repeated posture compliance
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
Detects one endpoint authenticating under several distinct user identities in a short
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
Detects a privileged account authenticating to destinations outside its established
pattern. Privileged accounts are usually scoped to a defined estate — a database
admin reaches databases, not workstations. Appearance outside that scope is lateral
movement using legitimate credentials, which endpoint tooling will not flag.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CYBERARK' and action='LOGIN'
| groupby user, dstip, srcip, authproto
pattern. Privileged accounts are usually scoped to a defined estate — a database
admin reaches databases, not workstations. Appearance outside that scope is lateral
movement using legitimate credentials, which endpoint tooling will not flag.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CYBERARK' and action='LOGIN'
| groupby user, dstip, srcip, authproto
Detects a privileged database login brokered through Arcon ARCOS from a source
address without prior history. ARCOS sits in front of database administrative access,
so it observes privileged DB sessions that database-native auditing often misses
entirely.
The extractor exposes a deliberately narrow field set — user, source address and
authentication protocol — so this detection is intentionally simple.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby user, srcip, authproto
address without prior history. ARCOS sits in front of database administrative access,
so it observes privileged DB sessions that database-native auditing often misses
entirely.
The extractor exposes a deliberately narrow field set — user, source address and
authentication protocol — so this detection is intentionally simple.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby user, srcip, authproto
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Detects anomalous sign-in activity for users by comparing current successful login attempts against a 14-day historical baseline. The rule flags logins originating from new IP addresses, new applications, or new geographic locations, specifically identifying instances where at least two of these parameters deviate from the established historical norm for the specific user.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Page 3 of 80