Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
247 detections
Filters
Last updated
All Time
Detection languages
114
83
40
6
2
Contributors
100
26
26
17
12
Categories
71
47
33
29
24
Platforms
93
89
54
28
8
Products / Services
10,661
9,758
6,692
4,418
3,749
247
MITRE Techniques
80
67
56
52
50
CVEs
4
4
3
2
2
Detects MFT authentication from a source address without prior history. Transfer
platforms are reached by a small, stable set of partners and internal systems, so
the population of legitimate source addresses is unusually predictable — which makes
a new one unusually meaningful.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| duration 24h
| groupby srcip, user, authproto
platforms are reached by a small, stable set of partners and internal systems, so
the population of legitimate source addresses is unusually predictable — which makes
a new one unusually meaningful.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| duration 24h
| groupby srcip, user, authproto
Detects a privileged command executed through Centrify on Windows. Brokered
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
Detects a source repeatedly denied by WebSEAL authorisation. Denials indicate
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
Detects unusual volumes of redirects through WebSEAL. Open or manipulable redirects
on an authentication gateway are valuable to an attacker: a link that genuinely
begins on the organisation's own trusted domain will survive scrutiny that an
external link would not.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_REDIRECTED'
| duration 1h
| groupby srcip, url, uriquery, returncode
on an authentication gateway are valuable to an attacker: a link that genuinely
begins on the organisation's own trusted domain will survive scrutiny that an
external link would not.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_REDIRECTED'
| duration 1h
| groupby srcip, url, uriquery, returncode
Detects configuration changes on the email inspector. Weakening sandbox analysis —
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects one internal host repeatedly triggering DNS threat blocks. A single block is
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
Detects the launch of bad-bpf style eBPF rootkit loaders (pidhide with --pid-to-hide, sudoadd with --username) executed via sudo or from an interactive shell parent, representing the userspace step that issues bpf(BPF_PROG_LOAD) before tracepoint hooks go live.
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
Detects repeated authentication failures at the IBM Security Access Manager reverse
proxy. WebSEAL fronts internal applications for external users, so it is the first
thing an attacker reaches and frequently the only control between the internet and
a legacy application that has none of its own.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ISAM-WEBSEAL' and action='LOGIN'
| duration 15m
| groupby srcip, status, reason
| select srcip, status, reason, distinct_count(user)
| having distinct_count_col1 > 8
proxy. WebSEAL fronts internal applications for external users, so it is the first
thing an attacker reaches and frequently the only control between the internet and
a legacy application that has none of its own.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ISAM-WEBSEAL' and action='LOGIN'
| duration 15m
| groupby srcip, status, reason
| select srcip, status, reason, distinct_count(user)
| having distinct_count_col1 > 8
Detects authentication to the BIG-IP management interface. These interfaces should
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
be reachable only from a management network; a login from anywhere else indicates
either an exposure that should not exist or an attacker who has already reached the
management plane.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='F5BIGIP' and action='LOGIN'
| groupby user, srcip, authproto
Detects a burst of failed authentications against Zimbra. Internet-facing webmail is
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
among the most consistently attacked surfaces in any estate, and Zimbra deployments
frequently sit outside the identity controls applied to the rest of the organisation.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='ZIMBRA' and action='LOGIN'
| duration 15m
| groupby srcip, reason
| select srcip, reason, distinct_count(user)
| having distinct_count_col1 > 10
Detects a role being added in Centrify for Linux. Roles determine which servers an
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
Detects a role change on the Mimecast platform. A gateway administrator can read
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
Detects modification of a monitored file on a Centrify-managed Linux host. File
integrity events on Unix servers catch tampering with configuration, authorised keys
and service definitions — the common Linux persistence routes, which leave no
registry trace and no Windows-style artefact.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='FILE_MODIFIED'
| groupby user, targetuser, domain
integrity events on Unix servers catch tampering with configuration, authorised keys
and service definitions — the common Linux persistence routes, which leave no
registry trace and no Windows-style artefact.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='FILE_MODIFIED'
| groupby user, targetuser, domain
Detects a source generating blocked packets across many destination ports. Branch
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
edge firewalls see lateral scanning between sites that a central firewall never
observes, because that traffic does not traverse the core.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED'
| duration 10m
| groupby srcip
| select srcip, distinct_count(dstport)
| having distinct_count_col1 > 25
Detects a message having its recipient altered during processing. Recipient
rewriting redirects mail away from its intended reader, and is a quiet way to
intercept correspondence or to suppress a notification that would otherwise reveal
an ongoing compromise.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TREND-MICRO-DDEI'
and action='EMAIL_RECIPIENT_CHANGED'
| groupby sender, recipient, direction, remoteip
rewriting redirects mail away from its intended reader, and is a quiet way to
intercept correspondence or to suppress a notification that would otherwise reveal
an ongoing compromise.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TREND-MICRO-DDEI'
and action='EMAIL_RECIPIENT_CHANGED'
| groupby sender, recipient, direction, remoteip
Detects a single account deleting a large number of files on the NAS. On shared
storage this is either ransomware working through the share, a destructive insider,
or an attacker removing backups before encrypting the primary estate.
NAS appliances rarely carry endpoint agents, so their own logs are frequently the
only place this is visible.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='DELETED'
| duration 10m
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 50
storage this is either ransomware working through the share, a destructive insider,
or an attacker removing backups before encrypting the primary estate.
NAS appliances rarely carry endpoint agents, so their own logs are frequently the
only place this is visible.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='DELETED'
| duration 10m
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 50
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Page 2 of 12