Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
363 detections
Filters
Last updated
All Time
Detection languages
167
84
32
27
19
Contributors
72
68
54
38
18
Categories
201
123
98
78
62
Platforms
215
118
97
39
7
Products / Services
76
69
48
32
25
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
2
1
IDS Classtypes
28
4
1
IDS Protocols
23
6
1
1
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects the execution of OpenConnect VPN clients on non-sanctioned devices followed within a 4-hour window by high-volume internal network connections across multiple ports indicative of network service discovery or pivoting activity.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects processes that make outbound API calls to known Large Language Model (LLM) domains while simultaneously performing high-volume network connection attempts or scanning-like fan-out activity across multiple public IP addresses.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects outbound network connections to known ClickFix campaign domains or the execution of the finger utility connecting to public IP addresses.
Detects processes that make outbound API calls to known Large Language Model (LLM) domains while simultaneously performing high-volume network connection attempts or scanning-like fan-out activity across multiple public IP addresses.
Detects enumeration of local or remote network services.
Detects a source generating blocked packets across many ports at a Meraki site.
Scanning between branch sites never traverses the core firewall, so without the
branch appliance's own logs this activity is invisible from the centre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Scanning between branch sites never traverses the core firewall, so without the
branch appliance's own logs this activity is invisible from the centre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Detects clients reaching for ports that are unreachable or not permitted. A client
repeatedly attempting wrong ports against brokered applications is enumerating what
the broker will allow, which is reconnaissance conducted entirely inside an
authenticated zero trust session.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('CLIENT_WRONG_PORT', 'PORT_UNREACHABLE')
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(dstport)
| having distinct_count_col1 > 10
repeatedly attempting wrong ports against brokered applications is enumerating what
the broker will allow, which is reconnaissance conducted entirely inside an
authenticated zero trust session.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('CLIENT_WRONG_PORT', 'PORT_UNREACHABLE')
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(dstport)
| having distinct_count_col1 > 10
Detects repeated blocked access requests through Zscaler Private Access. ZPA brokers
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
Detects a source generating blocked packets across many destination ports. Branch
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects a specific multi-stage exfiltration pattern characterized by initial reconnaissance/fingerprinting probes against sensitive service endpoints (/health, /docs, /openapi.json) followed by unauthorized access to artifact storage endpoints (/files or /file?name=) from the same device against the same host within a short timeframe.
Page 1 of 18