Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
5
1
Contributors
4
1
1
Categories
5
5
4
1
Platforms
5
Products / Services
6
5
4
MITRE Techniques
5
4
1
1
1
CVEs
71
71
64
58
49
IDS Classtypes
5
1
IDS Protocols
5
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects a successful FortiCloud SSO administrative login to a Fortinet appliance followed by the creation of a local administrator account from the same source IP and user within 15 minutes.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
This rule detects attempts to extract credentials from FortiGate devices by targeting specific management API endpoints. It looks for HTTP GET requests to '/api/v2/cmdb/' followed by paths like 'system/admin', 'vpn.ssl.settings', or 'user/local', which are known to contain sensitive configuration or user data. This activity is associated with the 'FortiBleed' campaign and CVE-2026-24858.
