Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Suspicious Connection to Custom GPT
Cortex XDR
Detects outbound web traffic to OpenAI ChatGPT Custom GPTs where the URL slug contains keywords potentially indicative of unauthorized or non-standard usage, such as keywords implying premium, professional, or official status, which could be used as a cover for data exfiltration or credential gathering via malicious or typo-squatted GPT instances.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.
Detects a large outbound transfer measured at the Versa edge. Branch sites typically
send modest volumes, so a sustained upload from one is either a backup nobody
documented or data leaving a location with the least security coverage in the
estate.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS'
and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
send modest volumes, so a sustained upload from one is either a backup nobody
documented or data leaving a location with the least security coverage in the
estate.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS'
and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
Detects DNS tunnelling, where data is encoded into queries and answers against a
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.
Detects the creation of specific GitHub repositories ('tpcp-docs' or 'docs-tpcp') associated with TeamPCP stealer fallback exfiltration activity, including subsequent release or asset creation.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects when a user performs a bulk data download (large volume of data) shortly after accessing restricted or sensitive SAP objects such as sensitive tables, ABAP programs, or transactions.
The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed.
It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies.
This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration.
If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies.
This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration.
If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
Detects the first-ever observed network connection from a device to WhatsApp Web or Telegram Web within a 30-day lookback period. This behavior is used to identify potentially unauthorized companion-device linking to a user's messenger account, which could indicate credential theft or unauthorized access.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure.
Detects the first-ever observed network connection from a device to WhatsApp Web or Telegram Web within a 30-day lookback period. This behavior is used to identify potentially unauthorized companion-device linking to a user's messenger account, which could indicate credential theft or unauthorized access.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
Page 3 of 124