Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,128 detections
Filters
Last updated
All Time
Detection languages
3,214
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,968
2,462
1,061
1,022
907
Platforms
39,781
7,128
6,515
3,860
3,597
Products / Services
1,324
1,062
969
655
488
MITRE Techniques
2,222
1,319
1,313
874
872
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Detects potential command injection exploitation patterns in ZimbraCollaboration suite where Java or Jetty processes spawn suspicious child processes such as shells or download utilities, followed by outbound public network connections.
Detects Linux persistence mechanisms involving potentially masqueraded systemd service/timer creation combined with subsequent systemctl enable actions, as well as suspicious cron job entries using common download utilities or interpreter flags.
Detects various anti-forensic and defensive evasion techniques on Linux systems, including clearing system and shell logs, bash/zsh history deletion or disabling, file timestomping via touch, and termination or tampering of security agents such as Cortex, Falcon, or Wazuh.
Detects potential exploitation of the libcurl CURLOPT_REQUEST_TARGET CRLF injection vulnerability via web/proxy request logs where curl user-agents are observed with carriage return/line feed characters or injected request lines within the URI path.
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
Finds BeyondTrust Remote Support (Bomgar) appliances at version 26.2.3 or earlier that have a public IP address, indicating a potentially internet-facing vulnerable appliance (CVE-2026-102764). Index and field names are placeholders to adapt.
Sweeps network connection, HTTP/proxy, file, and process telemetry for exact matches against known Cling botnet indicators: dedicated STUN C2/operator IPs, Cling MIPS loader staging URLs, and known Cling sample SHA256 hashes. Tightened to exclude broad domain-level matching on stun.l.google.com (legitimate, ubiquitous Google STUN infrastructure that Cling spoofs/abuses rather than owns) and to match payload-staging hosts only by full URL rather than bare IP, reducing false positives from shared/compromised hosting and unrelated legitimate STUN traffic.
Detects administrative login to the ePO console. An ePO administrator can change
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
Detects mail redirection on Zimbra Collaboration. Zimbra is widely deployed in
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
Detects a threat identified in Zimbra mail flow. Because Zimbra is both the mail
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
server and the webmail client, a threat here reaches the user directly without
passing any separate gateway — in many Zimbra deployments there is no other mail
security layer at all.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED'
| groupby sender, recipient, threat, srcip, dstip
Detects configuration changes on the Zimbra server. Mail server configuration
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects service state changes recorded by ePO. Protection services stopping and
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
Page 5 of 340