Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects connections held open far longer than normal. Interactive command and
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects persistent blocked web requests from one internal source. A person stops
after a block; software does not. Sustained retries after blocking indicate
automation attempting to reach a destination it has been configured to use.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user, category
| select srcip, user, category, count(*) as cnt
| having cnt > 25
after a block; software does not. Sustained retries after blocking indicate
automation attempting to reach a destination it has been configured to use.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user, category
| select srcip, user, category, count(*) as cnt
| having cnt > 25
Detects web access through Meraki content filtering. Branch users frequently work
without the endpoint controls applied at headquarters, so the network appliance is
often the only layer observing where they go.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='CISCO-MERAKI' and action='URL_ACCESSED'
| duration 1h
| groupby srcip, domain, url, useragent, user
without the endpoint controls applied at headquarters, so the network appliance is
often the only layer observing where they go.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='CISCO-MERAKI' and action='URL_ACCESSED'
| duration 1h
| groupby srcip, domain, url, useragent, user
Detects one internal source repeatedly blocked from reaching URLs. Persistent
attempts after a block indicate automated software rather than a person — a person
gives up, malware retries on a timer.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='VERSA-NETWORKS' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user
| select srcip, user, count(*) as cnt
| having cnt > 20
attempts after a block indicate automated software rather than a person — a person
gives up, malware retries on a timer.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='VERSA-NETWORKS' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user
| select srcip, user, count(*) as cnt
| having cnt > 20
Detects a threat raised by Versa Networks on a zero trust session. Versa sits at the
branch edge, so it observes traffic from sites that frequently have no local
security stack at all — in many estates it is the only sensor between a remote
office and the internet.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='VERSA-NETWORKS' and action='THREAT_DETECTED'
| groupby user, srcip, dstip, threat, process
branch edge, so it observes traffic from sites that frequently have no local
security stack at all — in many estates it is the only sensor between a remote
office and the internet.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='VERSA-NETWORKS' and action='THREAT_DETECTED'
| groupby user, srcip, dstip, threat, process
Detects a decoy asset initiating an outbound connection. A decoy should only ever
receive traffic. Outbound activity means the asset has been compromised and is being
used as a launch point, or that attacker tooling on it is calling home.
The destination is live command-and-control infrastructure and should be blocked
estate-wide immediately rather than only on the decoy.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and dstip != ''
| groupby dstip, url, process, srcip
receive traffic. Outbound activity means the asset has been compromised and is being
used as a launch point, or that attacker tooling on it is calling home.
The destination is live command-and-control infrastructure and should be blocked
estate-wide immediately rather than only on the decoy.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and dstip != ''
| groupby dstip, url, process, srcip
Detects one internal host repeatedly triggering DNS threat blocks. A single block is
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Page 2 of 60