Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
22
11
7
1
1
Contributors
8
7
5
4
4
Categories
13
12
12
9
8
Platforms
18
12
7
4
4
Products / Services
8
7
6
5
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
5
4
1
1
1
IDS Classtypes
6
1
IDS Protocols
4
2
1
Detects an endpoint or identity moving from a guest role to a corporate one. Guest
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
By default, the Windows guest account is heavily restricted, with limited permissions and access to system resources.
However, if the guest account is activated, it can potentially be used to perform malicious activities such as installing malware, deleting files, stealing data, or even taking control of the system.
However, if the guest account is activated, it can potentially be used to perform malicious activities such as installing malware, deleting files, stealing data, or even taking control of the system.
Detects instances where a successful login occurs on an ESXi/vCenter hypervisor, followed by the creation or power-on of a virtual machine on that same host within a two-hour window. This behavior is indicative of an attacker establishing access to a hypervisor environment to spin up rogue, unmonitored virtual machines to evade detection tools and facilitate further malicious activity.
Detects network activity related to the exploitation of Dahua P2P relay services via easy4ipcloud.com. The rule monitors for unauthorized device probing, serial number enumeration, and illicit relay authentication attempts (e.g., using DHP2P protocols and X-WSSE authentication), which are indicative of attackers attempting to abuse IoT device remote access functionality (CVE-2025-31702).
Detects outbound network traffic from internal devices interacting with Dahua Easy4IP cloud relay services, specifically identifying device resolution requests, probe actions, and the submission of WSSE authentication headers (UsernameToken and PasswordDigest) to the cloud relay host.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects unauthorized HTTP Basic authentication attempts targeting Cisco Firepower Management Center (FMC) using hardcoded service account credentials associated with CVE-2026-20316.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects a single host rapidly initiating outbound Telnet (port 23) or SSH (port 22) connection attempts against a large number of distinct remote IP addresses in a short window. This behavior is indicative of bot-agent scanners, such as those associated with IoT botnets, attempting to propagate by performing brute-force login attempts using default credential pairs.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
This rule detects attempts to log in to a Telnet server using the default credential 'admin'. It specifically looks for the string 'admin' in TCP traffic directed to the HOME_NET on port 23 (Telnet). A threshold of 3 attempts within 30 seconds from the same source IP triggers the alert, indicating a potential brute-force or default credential attack.
This rule detects attempts to access SNMP (Simple Network Management Protocol) services on the home network using the default community string 'public'. It specifically looks for the string 'public' within TCP traffic destined for port 161 (the standard SNMP port). A threshold of 5 attempts within 30 seconds from the same source IP will trigger an alert, indicating potential brute-force or reconnaissance activity against SNMP devices.
This rule detects multiple failed SSH login attempts using the username 'root' to a server on the home network. It triggers an alert if five such attempts occur within a 30-second window from the same source IP address. This behavior often indicates a brute-force attack targeting default credentials.
This rule detects attempts to log in to a web interface using default 'admin' credentials. It specifically looks for HTTP POST requests to a URI containing 'login' and a client body that contains 'admin' twice, indicating both username and password might be 'admin'.
Page 1 of 3