Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects access to Chrome or Chromium-based browser Local State files (which contain encrypted keys) by a non-browser process that correlates temporally with a PowerShell process exhibiting ClickFix-style staging characteristics (hidden window, bypass execution policy, and containing a URL).
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects a single non-browser process accessing the 'Web Data' files of multiple different web browser families within a short timeframe, which is indicative of credential harvesting or browser stealer activity.
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.
Detects the correlation between the loading of known stealer plugin DLLs outside of standard application paths and subsequent process activity accessing credential stores, sensitive files, or executing wireless key recovery commands.
Detects files transferred with a visibility or ownership change on the MFT platform.
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Detects Python interpreter activity accessing multiple credential store categories (such as password managers, Discord, SSH keys, or Steam) in a short window on a single device, or specific stealer scripts associated with known file paths.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects extensive file access on the NAS from a source address without prior
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects processes accessing sensitive files and configurations associated with multiple AI coding assistants (such as Claude, Codex, Grok, and Cursor) within a short time window, potentially indicating unauthorized access or credential theft from AI tools.
Detects non-browser processes accessing multiple sensitive browser credential/cookie files or cryptocurrency wallet files within a 24-hour window, which is a common indicator of credential theft or information stealer activity.
Detects access to files hosted on a decoy share. Decoy shares carry inviting names and
plausible content but hold nothing real and are linked from nowhere, so a file open is
deliberate discovery rather than a user stumbling into the wrong folder.
Which file was opened is itself intelligence: it indicates what the intruder is
looking for, and that shapes where you look next in the real estate.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and file != ''
| groupby file, user, srcip
plausible content but hold nothing real and are linked from nowhere, so a file open is
deliberate discovery rather than a user stumbling into the wrong folder.
Which file was opened is itself intelligence: it indicates what the intruder is
looking for, and that shapes where you look next in the real estate.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and file != ''
| groupby file, user, srcip
The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
The following analytic detects non-Firefox processes accessing the Firefox profile directory, which contains sensitive user data such as login credentials, browsing history, and cookies. It leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant because it may indicate attempts by malware, such as RATs or trojans, to harvest user information. If confirmed malicious, this behavior could lead to data exfiltration, unauthorized access to user accounts, and further compromise of the affected system.
The following analytic detects attempts to access or dump the contents of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Linux Auditd, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these files. This activity is significant as it may indicate credential dumping, a technique used by adversaries to gain persistence or escalate privileges. If confirmed malicious, privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise.
Detects unauthorized access to sensitive browser credential and session data files (e.g., Login Data, Cookies, Local State, key4.db) by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract saved credentials and session cookies to facilitate account takeover and bypass multi-factor authentication.
Page 1 of 76