Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,443
11,831
5,872
5,155
4,866
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects user accounts that have been disabled for an extended period (greater than 100 days), which could potentially be abused or overlooked.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects the creation or renaming of the 'ESX Admins' Active Directory security group combined with the addition of members to it, which is often used for privilege escalation or persistence in VMware ESXi environments managed via Active Directory.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects when a domain user account is renamed (Event ID 4781) where the old account name ends with a dollar sign (indicating a computer account) but the new name does not, or vice-versa, specifically checking if the new name matches a Domain Controller. This behavior can be indicative of account manipulation or exploitation attempts such as golden ticket or related attacks.
Detects new client secrets or certificates added to any service principal in Azure AD, specifically identifying activities linked to the ConnectWise supply-chain attack or suspicious user agents.
Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
principal.
This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
Detects a user account that performs a device code sign-in flow followed by the registration of five or more devices with deceptive names (matching patterns like microsoft- or windows-) within a one day timeframe. This behavior can indicate an adversary establishing persistence or attempting tenant resource exhaustion using compromised accounts.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
Detects a role change in Zendesk. An administrator can read every ticket, export
data, alter automations and add agents — and support platforms are a favoured
target for social engineering precisely because agents are trained to be helpful to
strangers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_UPDATED'
| groupby user, targetuser, role
data, alter automations and add agents — and support platforms are a favoured
target for social engineering precisely because agents are trained to be helpful to
strangers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_UPDATED'
| groupby user, targetuser, role
Detects an invitation into a GitHub organisation. Membership confers access to
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
Detects an account being unlocked through Centrify on Windows. Lockout is often the
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
Detects modification of user account attributes in Active Directory. Attribute
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
Detects a role modification shortly after failed authentication attempts for the same
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
identity. The sequence suggests someone unable to gain access through the front door
changing what the door permits, rather than continuing to try credentials.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_UPDATED'
| groupby user, targetuser, role, srcip
Detects a privileged password change shortly after failed authentication attempts
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Page 1 of 29