Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
24
10
10
6
Contributors
25
24
19
11
9
Categories
72
43
40
34
20
Platforms
73
47
18
16
11
Products / Services
46
13
9
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Correlates a device code flow sign-in event with bulk file downloads from SharePoint or OneDrive by the same user account within a 1-hour window. This behavior can indicate potential account compromise or misuse where an adversary uses device code phishing to authenticate and subsequently exfiltrate sensitive files.
Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.
Detects an export from Zendesk. Support platforms accumulate exactly what an
attacker wants for the next stage — customer names, contact details, account
references, and the content of conversations in which people routinely paste
things they should not. An export takes all of it at once.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=ticket-requested where sourcename='ZENDESK' and action='EXPORTED'
| groupby user, srcip, sourceclassification, sourcelabel
attacker wants for the next stage — customer names, contact details, account
references, and the content of conversations in which people routinely paste
things they should not. An export takes all of it at once.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=ticket-requested where sourcename='ZENDESK' and action='EXPORTED'
| groupby user, srcip, sourceclassification, sourcelabel
Detects export of the Atlassian audit log. An export hands over the full record of
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
Detects repositories being downloaded. Source code is intellectual property and
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
Detects established git actors (seen >7 days ago) originating from a newly observed source IP address (first seen within 24 hours) that perform a high volume of git operations (>=15) across multiple distinct repositories (>=10). This behavior often indicates compromised developer credentials being used to enumerate and clone source code repositories.
Detects sign-in activity originating from a known suspicious VPN/proxy IP range targeting critical Microsoft 365 applications. The rule specifically monitors for instances where multi-factor authentication (MFA) enforcement appears to be absent or failed, suggesting a potential account compromise and subsequent data access attempt via a proxy/VPN.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects anomalous, high-volume data retrieval from Salesforce via OAuth-authenticated Connected Apps using SOQL or Bulk API. This behavior is indicative of a compromised integration token being used by an adversary to exfiltrate sensitive CRM data, such as User, Account, Case, or Opportunity records, by bypassing standard user interface workflows.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
This rule detects potentially malicious bulk mailbox exfiltration operations (such as New-MailboxExportRequest, New-ComplianceSearch, or Search-Mailbox) performed by an account within 24 hours of experiencing a high or medium-risk sign-in event, suggesting post-compromise data harvesting.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects anomalous, high-volume automated API querying or bulk data exports within SaaS environments that target keywords associated with sensitive information, such as passwords, tokens, or configuration secrets. This pattern is characteristic of automated reconnaissance and unauthorized data harvesting, often observed in campaigns like those attributed to UNC6395.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Page 1 of 7