Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
8
8
2
1
1
Contributors
6
3
3
3
2
Categories
7
6
5
5
4
Platforms
9
4
3
2
2
Products / Services
5
3
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
IDS Classtypes
2
IDS Protocols
1
1
Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects configuration changes on a Barracuda load balancer. Load balancer
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects a rise in redirected web requests through the gateway. Redirection can
indicate traffic being steered somewhere other than the user intended, whether by
policy change or by interference further along the path.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_REDIRECTED'
| duration 1h
| groupby srcip, domain, url, category
indicate traffic being steered somewhere other than the user intended, whether by
policy change or by interference further along the path.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_REDIRECTED'
| duration 1h
| groupby srcip, domain, url, category
Detects potential poisoning of machine learning training data by identifying unauthorized file modifications to datasets, DVC repositories, or model registries that occur outside of authorized ETL or CI/CD windows.
Detects instances where a repository's GitHub CI/CD workflow, git configuration, or repository settings are modified, followed shortly thereafter by an npm package publish event. This behavior is indicative of a supply chain compromise where an adversary modifies workflow files to auto-publish malicious versions of a package.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
Detects the presence of a malicious HAProxy binary (version 2.8.12) that has been recompiled with an embedded 'ted' plugin. The plugin is designed to intercept and manipulate web traffic, as evidenced by specific strings related to pipe file handling, logging, and registration operations found within the binary.
This query detectsvinbound web requests containing a suspicious Content-Security-Policy or Content-Security-Policy-Report-Only request header with signs of nonce attribute breakout and JavaScript/data URI injection
This rule correlates a user logging in from a new ISP and immediately navigating to HR/Payroll URIs (specifically Workday or ADP) to modify direct deposit data. The detection logic joins Azure AD sign-in events with Cloud App Security events, filtering for interactive logins and page accesses to specific HR/Payroll URLs containing 'direct-deposit'. It also excludes known corporate IP addresses and requires the HR/Payroll access to occur within 30 minutes of the login.
This rule detects HTTP responses where the 'Content-Type' header is 'application/json' and the response body contains both 'balance' and '0.00' (case-insensitive). This combination, especially in the context of a 'trojan-activity' classification, suggests a potential Man-in-the-Middle (MitM) attack manipulating financial or account balance data within a JSON response to show a zero balance.
This rule detects potential tampering with financial transaction data during transit. It specifically looks for TCP traffic flowing to a server, where the data size is between 100 and 500 bytes, and the content contains both "amount" and "transfer" (case-insensitive). This combination suggests an attempt to modify financial transaction details.
This rule detects potential web server hijacking and traffic redirection activities, specifically focusing on techniques used by EtherRAT. It identifies scenarios where Nginx or Apache configurations are modified, often preceded by backup creation, and followed by a web server restart. Additionally, it looks for instances where configuration modifications are combined with attempts to exfiltrate data to webhook.site, suggesting a malicious redirection setup.
Modifications to a config that will serve an adversary's impacts or persistence
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
detects a possible IPv6 DNS takeover using ISATAP configuration events (Event ID 4100) new ISATAP router was set successfully
