Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
16
7
4
4
1
Contributors
6
5
4
3
3
Categories
7
5
3
2
2
Platforms
22
6
1
1
Products / Services
8
4
4
3
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
IDS Protocols
2
1
1
Detects authentication succeeding via MAC address where certificate or credential
based 802.1X is expected. MAC addresses are trivially spoofed, so a port falling back
to MAC authentication is a weak point an attacker can walk through by cloning the
address of a permitted device such as a printer or IP phone.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=authentication where sourcename='ARUBA-CLEARPASS' and action='LOGIN'
| groupby authproto, user, srcip, role
based 802.1X is expected. MAC addresses are trivially spoofed, so a port falling back
to MAC authentication is a weak point an attacker can walk through by cloning the
address of a permitted device such as a printer or IP phone.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=authentication where sourcename='ARUBA-CLEARPASS' and action='LOGIN'
| groupby authproto, user, srcip, role
Detects a DHCP lease request from a MAC address absent from the asset inventory. DHCP
sees every device that joins the network, including those with no agent, no domain
membership and no EDR — which makes it the only reliable place to catch unmanaged
hardware appearing on the wire.
Requires an inventory of known MAC addresses to compare against; without one this
detection has nothing to anchor to.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED'
| groupby macaddress, srcip, user
sees every device that joins the network, including those with no agent, no domain
membership and no EDR — which makes it the only reliable place to catch unmanaged
hardware appearing on the wire.
Requires an inventory of known MAC addresses to compare against; without one this
detection has nothing to anchor to.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED'
| groupby macaddress, srcip, user
Detects repeated lease denials for one MAC address. Denials occur when a device is
refused an address — commonly because it is not permitted on the segment — so a
device persistently retrying is attempting to join a network it has been excluded
from.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED'
| duration 1h
| groupby macaddress, resultcode
refused an address — commonly because it is not permitted on the segment — so a
device persistently retrying is attempting to join a network it has been excluded
from.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED'
| duration 1h
| groupby macaddress, resultcode
Detects the physical connection of unauthorized IP-KVM devices (e.g., PiKVM) to corporate endpoints, which could be used for remote control via HDMI capture and USB HID emulation. This detection monitors Plug and Play (PnP) events for specific device descriptors and hardware identifiers commonly associated with remote access hardware.
This rule detects the connection of USB devices identified as suspicious based on a curated list of Vendor IDs (VIDs) and Product IDs (PIDs). It monitors 'PnpDeviceConnected' events, extracts VID and PID from the device information, and cross-references them with an external list of known suspicious USB device identifiers. The rule aims to identify potentially malicious or unauthorized USB devices being connected to endpoints.
Detects network callbacks from hardware implants like O.MG Cable or USB Rubber Ducky
This rule detects a pattern indicative of a rogue network device performing keyboard injection. It specifically looks for the case-insensitive string "HID" (Human Interface Device) within TCP traffic flowing from a client to a server, with a threshold of 3 occurrences within 5 seconds from the same source. This behavior is often associated with devices like USB Rubber Ducky or similar tools used for automated keystroke injection.
This rule detects network connections from devices that might be Raspberry Pis or Hak5 devices, based on their HTTP User-Agent string. Specifically, it looks for User-Agents containing 'python-requests' or 'curl/' followed by a digit, indicating the use of common command-line tools or Python libraries for making HTTP requests. The rule is configured to trigger an alert if 10 such connections are observed from the same source IP within 10 seconds, suggesting automated or frequent activity.
This rule detects DHCP requests originating from a MAC address that is not recognized or expected within the network. It uses a threshold to prevent excessive alerts from a single source, triggering if a source makes more than one DHCP request within a 5-second window. This could indicate an unauthorized device attempting to join the network or a spoofed MAC address.
This rule detects Address Resolution Protocol (ARP) announcements from new or unknown devices on the network. Specifically, it looks for ARP packets with an opcode of '2', which signifies an ARP reply. The rule uses a threshold to trigger an alert if a new ARP reply is observed from a source within a 5-second window, indicating a potential new device joining the network or an attempt at ARP spoofing.
Detects if a new connector is registered on Azure AD; Azure AD Application Proxy is a feature of Microsoft Entra that allows you to securely publish on-premises applications to remote users. This is particularly useful for organizations that need to provide access to internal applications without exposing them directly to the internet.
Hunts for unwarranted hardware additions through USB device connections in macOS Unified Logs. In an environment where USB devices are not permitted.
In the absence of system.log, which used to show USB entries in previous macOS versions, this rule attempts to watch for this activity.
In the absence of system.log, which used to show USB entries in previous macOS versions, this rule attempts to watch for this activity.
Hunts for unwarranted hardware additions through USB device connections. In an environment where USB devices are not permitted.
This rule detects the connection of USB network interface cards (NICs) that are known to be used in Man-in-the-Middle (MITM) implants or other malicious hardware additions. It specifically looks for devices with Vendor IDs and Product IDs associated with suspicious chipsets like ASIX AX88772A (Hak5 LAN Turtle), ASIX AX88179, Realtek USB GbE (Pi-based dongles/implants), Realtek 10/100 USB Ethernet, and D-Link USB Ethernet (modded implants).
This rule detects the connection of suspicious USB Network Interface Controllers (NICs) that are commonly associated with Man-in-the-Middle (MITM) implants or other malicious hardware additions. It identifies specific Vendor IDs and Product IDs known to be used in devices like Hak5 LAN Turtle, ASIX AX88179, Realtek USB GbE (often found in Raspberry Pi-based implants), and D-Link USB Ethernet devices that have been observed in modded implants. The rule specifically filters for PnpDeviceConnected events related to network adapters.
This rule detects the connection of USB Network Interface Controllers (NICs) with specific Vendor and Product IDs known to be associated with suspicious devices often used in Man-in-the-Middle (MITM) implants. These include devices like the Hak5 LAN Turtle, Realtek USB GbE adapters (often found in Raspberry Pi-based implants), and D-Link USB Ethernet adapters that have been observed in modified implants. The rule specifically filters for 'PnpDeviceConnected' events where the device class is a network adapter.
This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
This rule identifies when a USB removable media device is attached to a Windows host by monitoring modifications to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry key. Adversaries and insider threats may use removable media devices for various malicious activities, including initial access, execution, and data exfiltration.
This analytic is used to identify when a USB removable media device is attached to a Windows host. It queries the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
Detects the connection of an IP KVM (Keyboard, Video, Mouse) device, which could be used for unauthorized remote access or data exfiltration.
This rule detects a potentially malicious Human Interface Device (HID) attack where a newly connected keyboard device (e.g., a USB Rubber Ducky) immediately triggers the execution of a script interpreter such as PowerShell, CMD, or MSHTA. The correlation occurs within 60 seconds of device insertion, which is characteristic of HID-based keystroke injection attacks.
Page 1 of 2