Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,612 detections
Filters
Last updated
All Time
Detection languages
1,725
689
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
727
629
473
Platforms
2,068
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
3,612
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects when a user authenticates via device code flow or performs device registration/ownership addition, followed by a bulk download of SharePoint or OneDrive files (25 or more distinct files) within a 60-minute window. This behavior can indicate session hijacking or unauthorized access where an attacker uses device code phishing to gain access and quickly exfiltrate cloud documents.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects a sequence where a device runs a staging/archiving utility (such as WinRAR, 7-Zip, or a copy script) followed within 4 hours by a file transfer or synchronization tool (such as rclone or FileZilla), which is indicative of data staging prior to exfiltration.
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Box Shield Anomalous Download
Cortex XDR
Surfaces Box Shield anomalous download alerts with full context extraction, including download delta, historical baseline vs anomaly period comparison, and source IPs.
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Detects high-volume Microsoft Graph API activity using attacker-associated user agents, such as python-requests, curl, or httpx, which may indicate automated token sweeping or data collection associated with supply-chain attacks.
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Detects a threat raised by the Cisco wireless LAN controller — rogue access points,
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
Correlates a device code flow sign-in event with bulk file downloads from SharePoint or OneDrive by the same user account within a 1-hour window. This behavior can indicate potential account compromise or misuse where an adversary uses device code phishing to authenticate and subsequently exfiltrate sensitive files.
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects potential data staging and exfiltration where sensitive or investigation-related files are compressed using archive utilities or PowerShell, followed closely by upload activities to Backblaze B2 cloud storage via CLI tools, rclone, or direct API connections.
Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.
M365 Malicious Mailbox Rule Abuse
Cortex XDR
Detects the creation or modification of Microsoft 365 Exchange inbox rules that exhibit characteristics of malicious behavior, such as using trivial or blank names, moving items to rarely-monitored folders (e.g., 'Conversation History', 'RSS Feeds'), or containing keywords related to phishing, credential harvesting, or financial fraud.
Detects mail redirection on Zimbra Collaboration. Zimbra is widely deployed in
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
Page 1 of 172