Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
86
27
13
10
7
Contributors
26
20
15
12
9
Categories
78
60
32
22
21
Platforms
44
41
24
23
17
Products / Services
26
16
15
14
13
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
6
5
5
5
4
IDS Classtypes
1
1
IDS Protocols
1
Detects the creation of WordPress administrator accounts using MySQL or WP-CLI command-line tools on hosts, specifically looking for specific username prefixes or email domains associated with suspicious activities.
Detects a new agent account in Zendesk. An agent can read customer conversations and
correspond with customers under the organisation's name — which makes an
unauthorised agent account both a data exposure and a channel for defrauding the
organisation's own customers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_ADDED'
| groupby user, targetuser, role
correspond with customers under the organisation's name — which makes an
unauthorised agent account both a data exposure and a channel for defrauding the
organisation's own customers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_ADDED'
| groupby user, targetuser, role
Detects account creation on the wireless controller. Network infrastructure accounts
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
Detects a user being added to a role within ClearPass. Role membership determines
what the network will permit an identity to reach, so granting a privileged role is
a network-layer privilege escalation that leaves no trace on any endpoint.
Additions outside provisioning hours, or by an account that does not normally
administer ClearPass, are the ones worth pursuing.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_ADDED'
| groupby user, targetuser, role, srcip
what the network will permit an identity to reach, so granting a privileged role is
a network-layer privilege escalation that leaves no trace on any endpoint.
Additions outside provisioning hours, or by an account that does not normally
administer ClearPass, are the ones worth pursuing.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_ADDED'
| groupby user, targetuser, role, srcip
Detects account creation on the NAS. Storage appliances are often administered
outside central identity management, so a local account created on one is both
durable persistence and largely invisible to directory-based monitoring.
An account created here survives domain-level remediation entirely.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='DISKSTATION-NAS' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
outside central identity management, so a local account created on one is both
durable persistence and largely invisible to directory-based monitoring.
An account created here survives domain-level remediation entirely.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='DISKSTATION-NAS' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
Detects creation of a database user observed by Guardium. Database-level accounts
frequently sit outside enterprise identity governance, which makes them attractive
persistence: an account created directly in the database survives directory cleanup
and is rarely reviewed.
Onboarding: IBM-GUARDIUM is ingested via Syslog (KV) (Bloo extractor 282).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='IBM-GUARDIUM' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
frequently sit outside enterprise identity governance, which makes them attractive
persistence: an account created directly in the database survives directory cleanup
and is rarely reviewed.
Onboarding: IBM-GUARDIUM is ingested via Syslog (KV) (Bloo extractor 282).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='IBM-GUARDIUM' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
Detects the creation or modification of a local NetScaler administrative account with superuser (nsroot-level) privileges via the appliance CLI or management API. This activity is indicative of persistent administrative backdoors potentially established after the exploitation of vulnerabilities such as CVE-2026-88771 or CVE-2026-88772.
Detects configuration changes to AAA/TACACS+ settings or the creation of local administrative accounts on network devices executed over SSH or Telnet sessions. This behavior is associated with malicious activity by groups such as Salt Typhoon, involving the compromise of telecommunications infrastructure.
Detects a suspicious pattern where a user authenticates via device code and, within a short timeframe (two hours), registers a new device to their account. This behavior is indicative of the 'ARToken' persistence pattern, where an adversary uses a stolen session to bind a rogue device to the victim's account, potentially to mint a Primary Refresh Token (PRT) for persistent access.
Detects the presence of an unauthorized administrative account (e.g., 'ops') on MikroTik RouterOS devices following a system 'Flagged' indicator. This rule correlates administrative account creation or modification events with system-reported compromise indicators to identify post-exploitation persistence mechanisms related to known RouterOS vulnerabilities.
Detects the execution of high-privilege administrative, firewall, or file-system commands by processes identified as autonomous agent runtimes (e.g., LangChain, AutoGPT) or Robotic Process Automation (RPA) tools. This rule surfaces potential unauthorized infrastructure changes or automated abuse by agents when direct change management validation is absent.
Detects the creation of new administrator or technician accounts within the SimpleHelp Remote Monitoring and Management (RMM) platform via API calls. This activity is often associated with unauthorized persistence creation by an adversary who has gained access to the platform.
Detects the modification or creation of Azure AD applications that include specific malicious redirect URIs associated with 'TrustSink' style attacks, which abuse external authentication callback mechanisms to intercept tokens and bypass MFA.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects modifications to Active Directory user accounts (Event IDs 4720, 4738) that coincide with suspicious MFA registration indicators—such as increased device counts, software token activations, or default device/token placeholders—within one hour of a successful user authentication event. This behavior is indicative of potential account takeover or persistence activities involving MFA manipulation.
Detects the creation or use of known backdoor accounts ('p2pwn', 'p2password') on Dahua surveillance devices, which are often utilized by adversaries to maintain unauthorized access to compromised hardware.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects the creation of a new user account in Nacos, followed immediately by an authentication failure and then a successful authentication, which may indicate an attacker using automated tools to create and test a backdoored administrative account.
Page 1 of 7