Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
484 detections
Filters
Last updated
All Time
Detection languages
151
135
74
42
39
Contributors
103
95
90
56
41
Categories
88
81
77
66
63
Platforms
211
209
108
108
71
Products / Services
10,680
9,761
6,694
4,418
3,744
484
MITRE Techniques
100
94
88
63
54
CVEs
6
6
5
4
4
Detects web server worker processes (such as PHP-FPM, Apache httpd, etc.) launching shells, interpreters, or download/network tools, which is a common post-exploitation pattern following remote code execution (RCE) vulnerabilities.
Detects the deployment of the ARTEX AI penetration testing framework via Docker/Docker-compose combined with the execution of offensive security and scanning tools (such as nmap, sqlmap, nuclei, httpx, apktool, frida) on the same host within a specified timeframe.
Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.
Detects potential vulnerability scanning, enumeration, or bulk data extraction against Request Tracker (RT) web paths by monitoring high request volumes, distinct URI counts, or large response byte sizes within CommonSecurityLog data.
Detects the Cisco AsyncOS content scanner / AMP service writing files into
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
sensitive system directories such as /etc, /root or /boot. CVE-2026-76519 uses a relative
path traversal in AMP attachment handling so a crafted email makes the root-running scanner
write attacker-chosen files wherever it likes. Writes outside the expected spool and
Content Scanner Tools directories are the core exploitation artifact.
Detects configuration changes on the Mimecast gateway. Mail gateway policy decides
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
what reaches the organisation; weakening it — disabling attachment protection,
adding a bypass for a sender, relaxing URL rewriting — opens a delivery path for
everyone at once and persists until someone notices.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST'
and action='CONFIGURATION_CHANGED'
| groupby user, srcip, reason
Detects export of the Atlassian audit log. An export hands over the full record of
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
Detects one account retrieving an unusually high number of distinct privileged
credentials in a short window. Legitimate privileged work involves one or two
checkouts for a specific task; sweeping the vault is what an attacker does after
compromising a PAM operator account, to harvest as much as possible before the
access is noticed.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 10
credentials in a short window. Legitimate privileged work involves one or two
checkouts for a specific task; sweeping the vault is what an attacker does after
compromising a PAM operator account, to harvest as much as possible before the
access is noticed.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 10
The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
Detects anomalous authentication patterns where a single source IP targets a high number of unique user accounts with failed authentication attempts over a rolling window. By filtering out SSO/Federated methods and specific service account patterns, this rule isolates low-and-slow brute-force or password-spraying activities designed to evade standard account lockout mechanisms.
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
Detects anomalous NetScaler session activity potentially indicative of session hijacking or token forgery. This includes identifying session tokens reused across different source IP addresses or user-agents within a short timeframe, as well as detecting session tokens utilized in traffic without a preceding recorded authentication or logon event.
This rule detects security alerts (IDS, WAF, or infrastructure logs) indicating exploitation attempts against JFrog Artifactory instances related to CVE-2026-66384, specifically involving cache poisoning techniques observed in recent threat campaigns.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects anomalous activity where AI assistant processes (e.g., Claude, ChatGPT, GitHub Copilot) execute a high volume of diverse discovery commands. The rule correlates multiple discovery categories, such as account, network service, system information, and network configuration discovery, occurring within a short timeframe to identify potential abuse of AI-integrated development tools for host reconnaissance.
This rule detects potentially malicious POST requests to SharePoint endpoints (such as AddGallery.aspx) that include indicators of WebPartMarkup or ToolPane payloads. This activity attempts to bypass the SPUtility.EnsureAuthentication() check that is typically enforced on the ToolPane.aspx page, potentially allowing unauthorized code execution or configuration manipulation.
Detects high-volume POST requests or traffic flagged by DLP mechanisms destined for known public generative AI platforms (e.g., OpenAI, Claude, Google Gemini). This rule identifies potential unauthorized transmission of sensitive or regulated data, such as PII or confidential information, to third-party AI services.
This rule monitors for network communication with a specific known malicious IP address and URL path, as well as the execution or presence of associated malicious file hashes. Additionally, it flags emails involving specific indicators identified as potentially associated with malicious activity.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
Detects high-frequency access requests directed at authentication or API endpoints originating from known Tor exit-node IP addresses. This activity is indicative of credential stuffing or automated scanning patterns that attempt to evade IP-based reputation or rate-limiting filters.
Page 1 of 24