Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
104 detections
Filters
Last updated
All Time
Detection languages
46
22
12
8
7
Contributors
23
15
8
7
5
Categories
37
25
21
21
16
Platforms
72
14
6
3
3
Products / Services
54
35
7
7
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects a privileged session launched from Secret Server. The launch is the moment
privileged access begins, and it carries the identity, the target and the source
address together — a cleaner attribution point than anything the target system will
record about a shared administrative account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='LAUNCHED'
| groupby user, file, filetype, srcip
privileged access begins, and it carries the identity, the target and the source
address together — a cleaner attribution point than anything the target system will
record about a shared administrative account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='LAUNCHED'
| groupby user, file, filetype, srcip
Detects a privileged account authenticating to destinations outside its established
pattern. Privileged accounts are usually scoped to a defined estate — a database
admin reaches databases, not workstations. Appearance outside that scope is lateral
movement using legitimate credentials, which endpoint tooling will not flag.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CYBERARK' and action='LOGIN'
| groupby user, dstip, srcip, authproto
pattern. Privileged accounts are usually scoped to a defined estate — a database
admin reaches databases, not workstations. Appearance outside that scope is lateral
movement using legitimate credentials, which endpoint tooling will not flag.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CYBERARK' and action='LOGIN'
| groupby user, dstip, srcip, authproto
Detects use of a vaulted privileged credential from a source address with no prior
history for that account. Privileged accounts operate from a narrow and stable set of
jump hosts; a new origin means either an undocumented access path or an attacker
operating the credential from their own foothold.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_USED'
| groupby user, targetuser, srcip, role
history for that account. Privileged accounts operate from a narrow and stable set of
jump hosts; a new origin means either an undocumented access path or an attacker
operating the credential from their own foothold.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_USED'
| groupby user, targetuser, srcip, role
Detects use of a credential seeded by the deception platform. Decoy credentials are
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
Detects retrieval of a privileged credential from the PAM360 vault outside normal
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738.
This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account.
The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464).
Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder.
A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case.
This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account.
The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464).
Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder.
A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case.
This rule monitors for high-impact configuration API calls and the creation of new administrator accounts within the Cisco Secure Firewall Management Center (FMC). These actions are indicative of post-exploitation activity related to CVE-2026-20079, which allows for authentication bypass. The detection focuses on sensitive administrative actions such as policy deployment, certificate exports, and user account creation which, if performed without valid session context, suggest an unauthorized actor.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects instances where a service account, identified by 'svc' in the account name, logs on and is assigned special privileges (Event ID 4672). This rule excludes computer accounts (ending in $) to minimize noise, as service accounts typically operate with specific, limited privileges and unusual privilege assignment could indicate an adversary abusing a service account for persistence or privilege escalation.
Detects potential Pass-the-Hash (PtH) activity where a single user account performs NTLM Type 3 (network) authentications to three or more unique destination hosts within a 10-minute window, excluding service account activity (trailing $). This pattern is consistent with an adversary moving laterally across a network using harvested NTLM hashes.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects high-risk domain account activity, specifically identifying either impossible-travel authentication patterns in cloud logs or rapid, multi-host interactive authentication fan-out within one hour. These detections are further correlated with subsequent RDP or WinRM session establishment, indicating potential lateral movement or compromise of legitimate accounts.
This rule detects potential lateral movement by identifying a single user account authenticating to three or more distinct hosts using NTLM via network (LogonType 3) or impersonation (LogonType 9) logons, which is characteristic of credential-based movement across a network.
This rule detects potential Kerberoasting activity by identifying an abnormal volume of RC4-encrypted Ticket Granting Service (TGS) requests (Event 4769) targeting service accounts, followed closely by a successful logon (Event 4624) from a previously dormant service account, suggesting the successful use of a cracked service ticket for unauthorized authentication.
Detects a cluster of Windows Event IDs 4740 (Account Lockout) or 4724 (Password Reset) targeting the local 'Administrator' account across multiple hosts within a short time window. This activity is indicative of automated or mass account manipulation often associated with ransomware payloads or centralized GPO-based credential tampering.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Identify cases where privileged tokens appear in unexpected contexts (e.g., admin accounts logging into low-tier devices, unusual logon types, or rare hosts).
Detects potential lateral movement or pivot attempts by correlating repeated failed RDP logons (RemoteInteractive) against sensitive targets (Domain Controllers, File Servers, Backup Servers) with concurrent security tool blocks (e.g., Microsoft Defender Antivirus, Exploit Guard) on the originating beachhead device within a 4-hour window.
Detects a single user account performing NTLM network logons (LogonType 3) to 3 or more distinct hosts within a short time period. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash, where an attacker uses compromised credentials to spread across a network.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Page 1 of 5