Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
2
1
Categories
2
2
1
1
1
Platforms
2
2
2
1
Products / Services
3
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
This rule detects suspicious network connections to known threat actor infrastructure associated with FortiGate exploitation, successful administrative or VPN logins to FortiGate devices from these IPs, and DCSync-style directory replication access (EventCode 4662) on Windows systems. The rule is composed of three distinct parts targeting different aspects of the attack chain.
Detects exploitation indicators of CVE-2022-42475, a heap-based buffer overflow vulnerability in FortiOS SSL-VPN's sslvpnd daemon. The rule specifically looks for the creation of known malicious files or configuration backups in specific directories, which are artifacts of successful exploitation.
