Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,420 detections
Filters
Last updated
All Time
Detection languages
530
348
171
163
130
Contributors
458
316
172
104
97
Categories
878
669
225
184
158
Platforms
1,332
232
184
47
31
Products / Services
10,680
9,761
6,694
4,418
3,744
1,420
MITRE Techniques
450
435
338
325
200
CVEs
28
22
10
9
7
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell).
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
Detects a PHP interpreter or PHP worker process (php-fpm, php-cgi, Apache httpd/apache2, or nginx workers) writing a new PHP-related script file into web root, upload, or temp directories. This is indicative of a webshell drop pattern following an unauthenticated remote code execution vulnerability.
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
Detects the execution of the php-up-2026 framework symbol extraction script (php_up_framework.py) using specific command line flags including --syms and --binary targeting the lsphp binary via python interpreters.
Detects web server processes (such as apache2, httpd, nginx, php-fpm) spawning a shell or curl process that performs LDAP queries using curl against URLs. This activity is indicative of Remote Code Execution (RCE) vulnerabilities being exploited against web applications to perform internal reconnaissance or LDAP enumeration.
Detects web server processes (apache2, httpd) spawning a Unix shell (sh, dash, bash) which subsequently executes curl, wget, or php to perform an external HTTP fetch or download. This behavior is commonly associated with PHP or web application post-exploitation callbacks (webshells).
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Detects operator synchronization scripts (sync-all.sh, sync-memory.sh, sync-cc-users.sh) spawning SSH, rsync, or scp commands targeting AI-named jump-server accounts (claude, grok, gemini, glm).
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Detects a web server process (apache2, httpd, php-fpm) spawning a Unix shell (dash/sh) that executes discovery commands such as id, whoami, hostname, or find. This is the durable post-exploitation signature of the wp2shell WordPress pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137), where a malicious plugin or webshell executes commands through the web stack.
Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects commands executed on a Barracuda load balancer. Network appliances sit
outside most endpoint monitoring, so their own audit trail is frequently the only
record that anyone logged in and did something.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='BARRACUDA-LOADBALANCER' and action='SESSION_ENDED'
| groupby user, process, commandline
outside most endpoint monitoring, so their own audit trail is frequently the only
record that anyone logged in and did something.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='BARRACUDA-LOADBALANCER' and action='SESSION_ENDED'
| groupby user, process, commandline
Detects service state changes recorded by ePO. Protection services stopping and
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
restarting across managed endpoints can indicate tampering — and because ePO
observes it centrally, the pattern across many hosts is visible in a way it is not
from any single machine.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED'
| duration 1h
| groupby user, process, commandline
Detects a privileged session beginning with no preceding credential retrieval by the
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects commands run on an F5 BIG-IP appliance. BIG-IP terminates TLS for the
applications behind it, which means the appliance holds private keys and sees
decrypted traffic — compromise of the load balancer is compromise of everything it
fronts, and the appliance itself rarely runs any endpoint agent.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='F5BIGIP' and action='USER_COMMAND_EXECUTED'
| groupby user, process, commandline, processargs
applications behind it, which means the appliance holds private keys and sees
decrypted traffic — compromise of the load balancer is compromise of everything it
fronts, and the appliance itself rarely runs any endpoint agent.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=auditd where sourcename='F5BIGIP' and action='USER_COMMAND_EXECUTED'
| groupby user, process, commandline, processargs
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Page 1 of 68