Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
44 detections
Filters
Last updated
All Time
Detection languages
17
13
6
3
2
Contributors
9
8
6
5
4
Categories
12
10
9
8
6
Platforms
12
9
6
6
4
Products / Services
6
6
5
4
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
IDS Protocols
2
1
Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects configuration changes on a Barracuda load balancer. Load balancer
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects a rise in redirected web requests through the gateway. Redirection can
indicate traffic being steered somewhere other than the user intended, whether by
policy change or by interference further along the path.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_REDIRECTED'
| duration 1h
| groupby srcip, domain, url, category
indicate traffic being steered somewhere other than the user intended, whether by
policy change or by interference further along the path.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_REDIRECTED'
| duration 1h
| groupby srcip, domain, url, category
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects unauthorized creation or modification of AI agent system prompts, guardrails, or policy configuration files. This rule monitors for changes made by processes or users other than those identified as authorized CI/CD deployment agents or service accounts, helping to prevent unauthorized tampering with AI agent behavior or safety policies.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects unauthorized modifications to AWS Bedrock Agent configurations, specifically identifying high-risk activities such as rewriting system prompts for potential prompt injection or attaching cross-account Lambda functions. The rule monitors for UpdateAgent, CreateAgentActionGroup, UpdateAgentActionGroup, and PrepareAgent events.
Detects the insertion of malicious prompt injection payloads—containing imperative commands to AI agents or hidden unicode/non-printable characters—into wiki pages, ticketing systems, or other shared knowledge bases. These payloads are designed to be ingested by AI agents or Retrieval-Augmented Generation (RAG) pipelines, leading to unauthorized instructions or behavioral overrides upon retrieval.
This rule detects potentially suspicious activity within a Git repository environment, specifically monitoring for code pushes, administrative changes (such as added collaborators, permission changes, or ownership transfers), and force push operations. It identifies high-impact repository modifications that could indicate unauthorized access, persistence, or attempts to disrupt repository integrity.
Detects unauthorized remote write operations (via SMB, Named Pipes, or TCP) to the Windows Certificate Services CertLog directory (C:\Windows\System32\CertLog\). This directory contains sensitive CA database, transaction logs, and checkpoint files. Any modification by a process other than the legitimate certsvc.exe is indicative of potential CA database tampering, malicious log manipulation, or anti-forensics activity.
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
This rule detects attempts to sabotage or brick Linux systems by monitoring for modifications or overwrites of critical system binaries responsible for reboot, shutdown, and power management, including 'reboot', 'shutdown', 'halt', 'poweroff', 'systemctl', and 'telinit'. It specifically identifies activity associated with the 'ELFOOD' header-corruption marker, a technique linked to the Tengu malware strain which prevents legitimate system reboots to maintain persistence and impede remediation efforts.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects the creation or modification of '.config' or '.exe.config' files within commonly user-writable directories such as AppData, Temp, Downloads, or Desktop. These files are often used by .NET applications to define behavior, and attackers may manipulate them to perform activities such as assembly redirection, loading malicious DLLs, or altering security settings for elevated processes.
Page 1 of 3