Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects Linux hosts running vulnerable kernel versions older than the fixed builds for CVE-2026-99999 (PwnEscape) across enterprise Linux branches (el8, el9, el10).
Detects an inbound QUIC/UDP port 443 burst targeting a Bun process (bun.exe or bun) from external IP addresses, followed by the process going completely silent on the network within a short time window. This pattern correlates with potential exploitation or denial-of-service conditions involving network parsing anomalies.
Detects the presence of vulnerable Wireshark software versions susceptible to CVE-2025-13945 and detects mitmproxy instances running without HTTP/3 disabled via the --set http3=false command line argument.
Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.
Detects the deployment or creation of containers (via Docker, Podman, Nerdctl, Crictl, or Kubectl) with elevated risk flags such as privileged mode, host namespace sharing, root mounts, docker socket access, or initiated from web application parent processes.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects administrative login to the ePO console. An ePO administrator can change
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
Detects mail redirection on Zimbra Collaboration. Zimbra is widely deployed in
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
Detects a threat identified in Zimbra mail flow. Because Zimbra is both the mail
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
Detects service state changes recorded by ePO. Protection services stopping and
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
Detects a burst of failed authentications against Zimbra. Internet-facing webmail is
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
Detects extensive file access on the NAS from a source address without prior
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
Page 11 of 347