Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects the execution of the rclone.exe utility with copy, sync, move, or copyto command-line arguments, correlated with outbound network connections to Wasabi S3 or MEGA cloud storage domains.
Detects processes that make outbound API calls to known Large Language Model (LLM) domains while simultaneously performing high-volume network connection attempts or scanning-like fan-out activity across multiple public IP addresses.
Detects a sequence where a device runs a staging/archiving utility (such as WinRAR, 7-Zip, or a copy script) followed within 4 hours by a file transfer or synchronization tool (such as rclone or FileZilla), which is indicative of data staging prior to exfiltration.
Detects the execution of Remote Monitoring and Management (RMM) tools followed closely (within 1 day) by potential data exfiltration activity using tools like WinSCP or Rclone, or connections to cloud storage providers (OneDrive, Google Drive) from the same device.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects a sequence where a device exhibits Remote Monitoring and Management (RMM) tool execution followed by high-volume outbound network connections to consumer cloud storage services (such as OneDrive or Google Drive) from the same device, potentially indicating data exfiltration via RMM.
Box Shield Anomalous Download
Cortex XDR
Surfaces Box Shield anomalous download alerts with full context extraction, including download delta, historical baseline vs anomaly period comparison, and source IPs.
Detects non-browser processes contacting multiple distinct cloud storage APIs within a one-hour timeframe, a pattern indicative of potential multi-service command and control or data exfiltration.
Detects a process with no prior AI API activity in the past 14 days suddenly generating a high volume (200+ calls) of network connections to public AI inference endpoints (OpenAI, Anthropic, Grok, OpenRouter). This behavior is consistent with stolen API keys being used to drain resources or exfiltrate data from a newly compromised host.
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Detects a data loss prevention violation. DLP telemetry is widely collected and
almost never written against as detection content — it is usually treated as a
compliance report rather than a security signal, which means repeated violations by
one user often go unexamined.
The file hash and process are both recorded, so a violation can be pivoted into
endpoint telemetry directly.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TRELLIX-DLP' and action='THREAT_DETECTED'
| groupby user, file, hash, process, threat, srcip
almost never written against as detection content — it is usually treated as a
compliance report rather than a security signal, which means repeated violations by
one user often go unexamined.
The file hash and process are both recorded, so a violation can be pivoted into
endpoint telemetry directly.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TRELLIX-DLP' and action='THREAT_DETECTED'
| groupby user, file, hash, process, threat, srcip
Detects files transferred with a visibility or ownership change on the MFT platform.
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Detects when a USB mass storage device is connected to a host and is followed shortly thereafter by a large volume of file creations or modifications on a removable drive, which may indicate data exfiltration or staging.
Detects potential data staging and exfiltration where sensitive or investigation-related files are compressed using archive utilities or PowerShell, followed closely by upload activities to Backblaze B2 cloud storage via CLI tools, rclone, or direct API connections.
Detects permitted transfers from a user who was recently blocked. Repeated blocks
followed by a success means a channel was found that the policy does not cover —
the user, or the attacker operating as them, worked out what gets through.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='TRELLIX-DLP' and action='PACKET_ALLOWED'
| duration 1h
| groupby srcip, dstip, dstport, app
followed by a success means a channel was found that the policy does not cover —
the user, or the attacker operating as them, worked out what gets through.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='TRELLIX-DLP' and action='PACKET_ALLOWED'
| duration 1h
| groupby srcip, dstip, dstport, app
Detects a substantial outbound transfer from a Meraki-protected site. Branch
locations have predictable, modest traffic profiles, which makes a sustained upload
unusually visible against that baseline compared with the same transfer leaving a
datacentre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
locations have predictable, modest traffic profiles, which makes a sustained upload
unusually visible against that baseline compared with the same transfer leaving a
datacentre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
Detects repository creation or addition to an organisation. Attackers use new
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a high volume of file creation events (greater than 200 files) on an external USB mount session by a non-system account, which may indicate potential data exfiltration or staging to removable media.
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Detects potential data exfiltration activity where a device first exhibits usage of a remote monitoring and management (RMM) tool, followed by the execution of known data transfer or exfiltration utilities such as WinSCP or Rclone.
Page 1 of 124