Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
1
1
1
1
1
Platforms
2
1
Products / Services
2
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.
Detects if the Fortinet firewall configuration has been exported.
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
