Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
496 detections
Filters
Last updated
All Time
Detection languages
406
57
13
12
6
Contributors
387
54
19
12
8
Categories
145
105
65
45
36
Platforms
388
31
21
18
13
Products / Services
205
137
62
40
28
MITRE Techniques
18,101
15,564
12,552
8,361
6,162
CVEs
2
1
Detects a web request bypassing SafeSquid filtering policy. The extractor exposes
BYPASSED as a distinct action, which is unusual and valuable — most gateways record
only allow or block, so a bypass is normally indistinguishable from an allow.
A bypass means policy was deliberately not applied to that request, and the question
is who arranged that.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='BYPASSED'
| groupby srcip, user, domain, url, category
BYPASSED as a distinct action, which is unusual and valuable — most gateways record
only allow or block, so a bypass is normally indistinguishable from an allow.
A bypass means policy was deliberately not applied to that request, and the question
is who arranged that.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='BYPASSED'
| groupby srcip, user, domain, url, category
Detects configuration changes on the FortiWeb WAF. Disabling a signature, adding an
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
Detects configuration changes to DLP policy. Weakening the policy — excluding a
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
channel, removing a classification, allowing a destination — opens an exfiltration
route for everyone it covers, and unlike most controls, DLP changes rarely trigger
any operational complaint to reveal them.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TRELLIX-DLP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects authentication to the MFT platform where multi-factor was not initiated.
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
Detects configuration changes on the MFT platform. Configuration governs who may
transfer what, to where, and whether it is logged — so a change can open an
exfiltration path or silence the record of one, and it persists until somebody
reviews the configuration again.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='GOANYWHERE-MFT'
and action='CONFIGURATION_CHANGED'
| groupby user, config
transfer what, to where, and whether it is logged — so a change can open an
exfiltration path or silence the record of one, and it persists until somebody
reviews the configuration again.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='GOANYWHERE-MFT'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects configuration changes on the Mimecast gateway. Mail gateway policy decides
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
Detects quarantined messages being released at volume. Release overrides the
gateway's own verdict, so a burst of releases either reflects a false positive wave
or an attacker with administrative access letting their own delivery through the
control that stopped it.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MIMECAST' and action='EMAIL_QUARANTINED'
| duration 1h
| groupby sender, recipient, direction
gateway's own verdict, so a burst of releases either reflects a false positive wave
or an attacker with administrative access letting their own delivery through the
control that stopped it.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MIMECAST' and action='EMAIL_QUARANTINED'
| duration 1h
| groupby sender, recipient, direction
Detects deletion of a Jira issue security scheme. These schemes restrict who can see
sensitive issues — security findings, HR matters, incident records. Removing one can
expose restricted issues to the whole project at a stroke, and it is a quiet way to
gain access to material that was deliberately walled off.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=jira-project where sourcename='ATLASSIAN'
and action='SECURITY_SCHEME_DELETED'
| groupby user, project, issuesecurityscheme, permissionscheme
sensitive issues — security findings, HR matters, incident records. Removing one can
expose restricted issues to the whole project at a stroke, and it is a quiet way to
gain access to material that was deliberately walled off.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=jira-project where sourcename='ATLASSIAN'
and action='SECURITY_SCHEME_DELETED'
| groupby user, project, issuesecurityscheme, permissionscheme
Detects configuration changes on the email inspector. Weakening sandbox analysis —
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects a successful network admission following repeated posture compliance
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
Detects modification of ISE configuration governing who may join the network and
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
Detects a change in authentication protocol for privileged database access brokered
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
by ARCOS. A downgrade to a weaker protocol for an account that previously used a
stronger one suggests either a misconfiguration that weakens the estate or an
attacker steering authentication toward a method they can intercept or replay.
Baseline the protocol per account before deployment; some legacy database clients
genuinely only support older methods.
Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN'
| groupby authproto, user, srcip
Detects configuration changes to Oracle Audit Vault. The Vault is the integrity
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
control for database auditing, so altering its configuration can stop collection,
narrow what is recorded, or redirect the audit trail — removing the evidence of
whatever follows.
Treat any change here as affecting the reliability of all database audit data for
the period concerned.
Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ORACLE-AUDIT-VAULT'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip
Detects an endpoint repeatedly failing compliance evaluation. Persistent failure
means either a device nobody is maintaining, or one where a control is being actively
disabled and re-detected — security software stopped, patches removed, agent
tampered with.
Onboarding: FORESCOUT is ingested via Syslog (CEF) (Bloo extractor 247).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='FORESCOUT' and action='COMPLIANCE_CHECK'
| duration 24h
| groupby user, policy, reason
means either a device nobody is maintaining, or one where a control is being actively
disabled and re-detected — security software stopped, patches removed, agent
tampered with.
Onboarding: FORESCOUT is ingested via Syslog (CEF) (Bloo extractor 247).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='FORESCOUT' and action='COMPLIANCE_CHECK'
| duration 24h
| groupby user, policy, reason
Detects a rise in dropped or suppressed mail. Transport rules that silently discard
messages can be used to hide security alerts, suppress notifications of account
changes, or conceal an ongoing compromise from the people who would otherwise notice
it.
Mail that never arrives generates no complaint for some time, which is precisely why
this is worth watching.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action in ('EMAIL_DROPPED', 'EMAIL_SUPPRESSED')
| duration 1h
| groupby recipient, sender, direction
messages can be used to hide security alerts, suppress notifications of account
changes, or conceal an ongoing compromise from the people who would otherwise notice
it.
Mail that never arrives generates no complaint for some time, which is precisely why
this is worth watching.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action in ('EMAIL_DROPPED', 'EMAIL_SUPPRESSED')
| duration 1h
| groupby recipient, sender, direction
Detects the creation of new files with the ".evtx" extension in non-common or non-standard location.
This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.
Note that backup software and legitimate administrator might perform similar actions during troubleshooting.
This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.
Note that backup software and legitimate administrator might perform similar actions during troubleshooting.
Detects the degradation of the system firewall security by the DoNotAllowExceptions policy value being
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
set to 0 (DWORD 0x00000000), which re-enables application and port exceptions in the Microsoft
Defender Firewall and can restore network paths that a hardened profile would block.
Detects the Cisco AsyncOS content scanner / AMP service writing files into
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.
A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
This can be done programmatically via HTTP requests to Azure.
A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.
This can be done programmatically via HTTP requests to Azure.
Page 2 of 24