Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
496 detections
Filters
Last updated
All Time
Detection languages
406
57
13
12
6
Contributors
387
54
19
12
8
Categories
145
105
65
45
36
Platforms
388
31
21
18
13
Products / Services
205
137
62
40
28
MITRE Techniques
18,101
15,564
12,552
8,361
6,162
CVEs
2
1
This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
Detects pre-encryption behaviors where an adversary or script stops or disables multiple critical services (such as backup solutions, databases, and security software) using standard Windows utilities (sc.exe, net.exe, taskkill.exe, powershell.exe) in a short timeframe, commonly observed prior to ransomware deployment.
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Detects modifications to Entra ID federation settings, domain authentications, and trust configurations via AuditLogs. This includes operations like setting federation settings, adding unverified or verified domains, and updating domain properties, which can indicate backdoor creation or trust manipulation.
Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
Detects the loading of known vulnerable drivers (often used in Bring Your Own Vulnerable Driver attacks) or drivers loaded from user-writable paths outside of trusted directories.
Detects attempts to tamper with Microsoft Defender services, features, configurations, exclusions, and policy registry keys over a 30-minute aggregation window per device. High-confidence events include stopping Defender services or disabling real-time protection via commands or tampering events, while multiple lower-confidence events (such as adding exclusions or disabling cloud protection) combined together also trigger an alert.
Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall
Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL.
Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.
Detects Java processes spawning PowerShell or Command Prompt to modify Windows Defender settings by adding exclusions for sensitive paths or extensions (such as AppData, Temp, Users Public, or ProgramData).
Detects configuration changes on the Zimbra server. Mail server configuration
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects modification of HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData to a Windows kernel object namespace path such as \\.\globalroot\BaseNamedObjects\Restricted. The LegacyHive 0-day exploits this registry pivot to redirect UsrClass.dat loading via the Windows User Profile Service, achieving privilege escalation on all supported desktop and server versions with the July 2026 patch applied. No legitimate application redirects a user shell folder to a kernel namespace path.
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts
Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
Detects a sequence of events indicative of Bring Your Own Vulnerable Driver (BYOVD) attacks or security control impairment. It monitors for the loading of a rare driver (seen on 3 or fewer hosts), accompanied by either the creation of a kernel service or defense tampering activities such as disabling security monitoring or stopping security-related services.
Detects Azure data exfiltration staging activity resembling Storm-2949 or Storm-0501 techniques. This includes exposing cloud storage or SQL servers by modifying firewall rules to allow open access, subsequently deleting those rules, or performing mass listing of storage account keys.
Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.
Detects various anti-forensic and defensive evasion techniques on Linux systems, including clearing system and shell logs, bash/zsh history deletion or disabling, file timestomping via touch, and termination or tampering of security agents such as Cortex, Falcon, or Wazuh.
Detects notification mail sent by ePO, including its recipients. Redirecting or
suppressing ePO notifications means endpoint security alerts stop reaching the team
that would act on them — the alerts still fire, nobody reads them.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TRELLIX-EPO' and action='EMAIL_SENT'
| groupby sender, recipient, direction, remoteip
suppressing ePO notifications means endpoint security alerts stop reaching the team
that would act on them — the alerts still fire, nobody reads them.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TRELLIX-EPO' and action='EMAIL_SENT'
| groupby sender, recipient, direction, remoteip
Detects configuration changes on the SafeSquid gateway. Adding a bypass or relaxing
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
Page 1 of 24