Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,735 detections
Filters
Last updated
All Time
Detection languages
1,216
144
98
80
59
Contributors
496
324
298
171
55
Categories
20,440
11,814
5,871
5,145
4,864
1,735
Platforms
1,163
328
260
244
163
Products / Services
1,244
200
166
146
138
MITRE Techniques
983
923
765
247
245
CVEs
2
1
IDS Classtypes
68
33
19
10
8
IDS Protocols
90
24
15
15
Detects an inbound email flood attack (many distinct senders to a single recipient within a 5-minute window) followed by an external Microsoft Teams message sent to the same user, typically associated with IT support pretexting or callback phishing attacks.
Detects external Microsoft Teams messages containing support-related social engineering lures or originating from known malicious/IOC tenant domains, summarizing sender and thread metrics. The query ran without errors in a live tenant.
Detects a potential multi-stage social engineering attack where a user first receives a high volume of emails (mail-bomb burst) within a short window, followed shortly by an external Microsoft Teams message from a suspicious throwaway tenant using an IT help desk display name.
Detects inbound emails impersonating OpenCode breach notices that urge API key rotation and contain links to non-OpenCode domains.
Detects a potential social engineering or phishing attack pattern where a recipient first receives a high volume of inbound emails (mail flood) within a short window, followed quickly by an external Microsoft Teams chat message from an IT-themed sender attempting to impersonate internal support.
Detects incoming xAI invitation emails from noreply@x.ai containing URLs that do not belong to the x.ai domain, which may indicate a phishing attempt or link injection.
Detects delivered emails where the subject line matches a specific pattern (five digits followed by a hyphen and text) and the attachment filename corresponds to the extracted subject text, ending with 'Document.xlsx', and the email was not quarantined post-delivery.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Users who received a delivered phishing email and then signed in from an IP not seen for them in the prior 30 days within 24 hours. Hunting query, not an alert.
Detects a threat identified in Zimbra mail flow. Because Zimbra is both the mail
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
Detects a threat identified by Deep Discovery Email Inspector. DDEI detonates
attachments and inspects URLs in a sandbox, so its verdicts carry behavioural
evidence rather than signature matches — which makes them a strong input for
detections that most estates never ingest.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TREND-MICRO-DDEI' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, threattype, srcip
attachments and inspects URLs in a sandbox, so its verdicts carry behavioural
evidence rather than signature matches — which makes them a strong input for
detections that most estates never ingest.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TREND-MICRO-DDEI' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, threattype, srcip
Detects threats identified by Mimecast where the same sender appears repeatedly.
A single blocked message is routine; the same origin returning again and again is a
campaign specifically targeting this organisation, and the repetition is the signal
worth acting on rather than the individual block.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=threat where sourcename='MIMECAST' and action='THREAT_DETECTED'
| duration 24h
| groupby sender, srcip
| select sender, srcip, distinct_count(recipient)
| having distinct_count_col1 > 5
A single blocked message is routine; the same origin returning again and again is a
campaign specifically targeting this organisation, and the repetition is the signal
worth acting on rather than the individual block.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=threat where sourcename='MIMECAST' and action='THREAT_DETECTED'
| duration 24h
| groupby sender, srcip
| select sender, srcip, distinct_count(recipient)
| having distinct_count_col1 > 5
Detects incoming xAI invitation emails from noreply@x.ai containing URLs that do not belong to the x.ai domain, which may indicate a phishing attempt or link injection.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Detects instances where an email previously detected as malware or phishing and quarantined is subsequently released and the recipient interacts with/clicks URLs contained within the email.
Page 1 of 83