Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
3
1
1
Categories
5
5
4
3
3
Platforms
5
1
Products / Services
5
3
3
1
MITRE Techniques
5
4
2
1
CVEs
71
71
64
58
49
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
Detects suspicious HTTP requests and API activity targeting Fortinet devices, specifically matching patterns associated with known vulnerabilities like CVE-2022-40684 and CVE-2024-21762. The rule monitors for unauthorized REST API calls, attempts to interact with sensitive administrative endpoints, and patterns indicating potential authentication bypass or remote code execution attempts on FortiGate, FortiOS, and FortiProxy appliances.
The following analytic detects attempts to exploit CVE-2022-40684, a Fortinet appliance authentication bypass vulnerability. It identifies REST API requests to the /api/v2/ endpoint using various HTTP methods (GET, POST, PUT, DELETE) that may indicate unauthorized modifications, such as adding SSH keys or creating new users. This detection leverages the Web datamodel to monitor specific URL patterns and HTTP methods. This activity is significant as it can lead to unauthorized access and control over the appliance. If confirmed malicious, attackers could gain persistent access, reroute network traffic, or capture sensitive information.
