Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects Windows PE executable files written to disk with company metadata matching Sysinternals (Sysinternals - www.sysinternals.com). This detection identifies the presence of Sysinternals tools on endpoints for security monitoring and investigation.
Sysinternals tools are legitimate administrative utilities but may also be leveraged by threat actors for reconnaissance, process inspection, credential access, and lateral movement. Review the file path, SHA-256 hash, user context, and associated process activity to determine whether the file is authorized or potentially suspicious.
Note: The presence of a Sysinternals executable alone does not indicate malicious activity.
Sysinternals tools are legitimate administrative utilities but may also be leveraged by threat actors for reconnaissance, process inspection, credential access, and lateral movement. Review the file path, SHA-256 hash, user context, and associated process activity to determine whether the file is authorized or potentially suspicious.
Note: The presence of a Sysinternals executable alone does not indicate malicious activity.
Detects a source repeatedly denied by WebSEAL authorisation. Denials indicate
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
Detects a pattern of previewing many files then downloading a subset. This is
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
Detects the use of vim and its siblings commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or breaking out from restricted environments.
Detect adversaries enumerate sensitive files
The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and directories, this analytic helps security teams detect potential reconnaissance or preparatory actions by an attacker, enabling timely intervention to prevent data breaches or unauthorized access.
Detects unauthorized access, reading, or downloading of sensitive NetScaler system files, including configuration files (ns.conf), licensing files, and cryptographic material (private keys/certificates). This activity often indicates post-exploitation reconnaissance, staging, or data theft attempts following initial access.
Detects repeated attempts to perform IIS 8.3 tilde short-filename enumeration. This reconnaissance technique exploits the legacy DOS 8.3 file naming convention to identify the existence and naming of files or directories on a Microsoft IIS web server.
Detects unauthorized processes attempting to read sensitive wallet extension storage files or desktop application wallet data folders, a behavior characteristic of the Psychedelic Stealer malware designed to harvest cryptocurrency credentials prior to exfiltration.
Detects instances where common scripting engines like Python or Node.js are used to spawn command shells (CMD, PowerShell, or Bash) followed by the execution of suspicious commands commonly associated with reconnaissance, file exfiltration, or lateral movement.
Detects the execution of Nova ransomware (formerly RALord) by monitoring for its specific modular command-line interface arguments, which include file encryption commands, ransom note deployment, and specific ransom note filenames. The rule monitors process creation events for strings like 'encrypt-all', 'encrypt-path', 'readme-add', '--workers', and the presence of the 'README_NOVA.me' ransom note or unique file extensions associated with its encryption activity.
Detects unauthorized file deletion activity performed directly by a Node.js process acting as a ChainScript RAT. The RAT uses a bundled node.exe process, operating within specific masquerading directories in the user profile, to execute file system operations such as recursive deletion without spawning child processes.
Detects unauthorized file creation within the /root/.hermes/loot/ directory and specific path combinations associated with the CARBONATO botnet's Hermes Agent. This activity is indicative of credential harvesting, specifically the exfiltration of AI API keys for various LLM providers.
Detects HTTP traffic associated with the NeedyMantis malware, specifically identifying initial beacons to a known C2 domain using a specific User-Agent, followed by command-and-control response headers that suggest the exfiltration of reconnaissance data via the Set-Cookie field.
Detects high-frequency access to the root of the C:\ drive using access rights typically required for directory change notification. This behavior is a heuristic proxy for processes attempting to monitor the entire file system (e.g., via ReadDirectoryChangesW), often associated with post-compromise reconnaissance or surveillance of file operations.
Detects interpreter processes (e.g., python, node, bash) typically used for AI agents accessing sensitive system files or directories outside of defined sandbox or workspace paths. This behavior suggests potential sandbox escape or unauthorized path traversal by an AI agent.
Detects a suspicious sequence of reconnaissance activities associated with ShinyHunters campaigns targeting PeopleSoft environments. The pattern involves reading '/etc/hosts' using standard utilities ('cat', 'grep', 'awk') followed by rapid network discovery or probing attempts using 'curl', 'wget', 'nmap', or 'nc' from the same host within a 10-minute window.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Page 1 of 31