Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the odbcconf LOLBin delivery step assessed for the MuddyWater-linked PatchAgent chain: 'odbcconf /f cloud.rsp' launched from a PatchAgent working directory, typically via a ClickFix lure (explorer -> conhost --headless -> cmd -> odbcconf) fetching the response file over WebDAV. odbcconf executing a .rsp response file is rare in legitimate use and is high-fidelity when paired with WebDAV or a user-writable working directory.
Detects msiexec.exe executing an MSI package named update_ms.msi
staged in ProgramData. Chaos ransomware disguises this installer's properties
and filename to impersonate a legitimate Windows Update package. On execution,
a custom action (CA_Run_EA2AEBC3) loads an embedded DLL (Bin_lib_EA2AEBC3,
lib.dll) directly into memory, deploying the msaRAT payload. This rule sees
the installer execution only; the in-memory module load is not observed here
and would need a separate PROCESS_MODULE_LOAD rule.
staged in ProgramData. Chaos ransomware disguises this installer's properties
and filename to impersonate a legitimate Windows Update package. On execution,
a custom action (CA_Run_EA2AEBC3) loads an embedded DLL (Bin_lib_EA2AEBC3,
lib.dll) directly into memory, deploying the msaRAT payload. This rule sees
the installer execution only; the in-memory module load is not observed here
and would need a separate PROCESS_MODULE_LOAD rule.
Detects use of wmic to add Microsoft Defender scan exclusions via the
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects an uncommon svchost parent process
Detects successful Google Workspace logins from an IP address or user agent not previously seen for the user within a 24-hour window.
Detects authentication to the BIG-IP management interface. These interfaces should
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
Detects use of a credential seeded by the deception platform. Decoy credentials are
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
Detects retrieval of a privileged credential from the PAM360 vault outside normal
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
Detects one MAC address obtaining an unusual number of distinct leases. Legitimate
devices hold a lease and renew it. Rapid cycling suggests either MAC spoofing or a
device deliberately churning addresses to frustrate tracking and evade controls bound
to an IP.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED'
| duration 1h
| groupby macaddress
| select macaddress, distinct_count(srcip)
| having distinct_count_col1 > 5
devices hold a lease and renew it. Rapid cycling suggests either MAC spoofing or a
device deliberately churning addresses to frustrate tracking and evade controls bound
to an IP.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED'
| duration 1h
| groupby macaddress
| select macaddress, distinct_count(srcip)
| having distinct_count_col1 > 5
Detects an endpoint flipping between compliant and non-compliant repeatedly in a
short period. Stable devices stay in one state. Rapid oscillation suggests something
is being disabled and restored — a security agent stopped and restarted, or posture
data being manipulated to satisfy the check only when it is being observed.
Onboarding: FORESCOUT is ingested via Syslog (CEF) (Bloo extractor 247).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='FORESCOUT' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy
| select user, policy, count(*) as cnt
| having cnt > 6
short period. Stable devices stay in one state. Rapid oscillation suggests something
is being disabled and restored — a security agent stopped and restarted, or posture
data being manipulated to satisfy the check only when it is being observed.
Onboarding: FORESCOUT is ingested via Syslog (CEF) (Bloo extractor 247).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='FORESCOUT' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy
| select user, policy, count(*) as cnt
| having cnt > 6
The following analytic detects a process enabling the "SeDebugPrivilege" privilege token. It leverages Windows Security Event Logs with EventCode 4703, filtering out common legitimate processes. This activity is significant because SeDebugPrivilege allows a process to inspect and modify the memory of other processes, potentially leading to credential dumping or code injection. If confirmed malicious, an attacker could gain extensive control over system processes, enabling them to escalate privileges, persist in the environment, or access sensitive information.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects the Shai-Hulud supply chain attack dead-man's switch: a gh-token-monitor persistence component followed by a recursive forced deletion of the user home directory, or the presence of the specific kill-switch string in a command line.
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects the use of msxsl.exe or wmic.exe to process .xsl or .xslt files, potentially indicating the execution of embedded scripts. The rule calculates a risk score based on the combination of the utility name, the presence of an XSL/XSLT file reference in the command line, usage of suspicious file paths (e.g., Temp, AppData), and being launched by potentially suspicious parent processes like cmd.exe or powershell.exe.
The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.
Page 8 of 864