Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
289 detections
Filters
Last updated
All Time
Detection languages
109
73
41
24
20
Contributors
58
47
46
33
19
Categories
68
66
59
48
40
Platforms
224
51
50
23
10
Products / Services
10,665
9,773
6,704
4,421
3,749
289
MITRE Techniques
69
68
65
54
43
CVEs
12
6
6
6
5
IDS Classtypes
18
3
2
2
1
IDS Protocols
21
2
1
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects potential Cobalt Strike or Sliver command and control (C2) beaconing behavior by analyzing network proxy, firewall, and flow logs for common C2 URI patterns, known malicious JA3/JA3S TLS fingerprints, and consistent periodic communication intervals (low jitter) characteristic of automated beacons.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
This rule monitors network device logs for patterns indicative of reconnaissance or vulnerability scanning against management and VPN interfaces of common firewall and network appliances (FortiGate, Meraki, WatchGuard, Sophos). It flags sources that either request multiple sensitive paths related to system status and configuration or employ known scanning tools (Nmap, masscan, Nuclei, zgrab, curl) in the user-agent string.
This rule identifies potential brute force or password spraying attacks against network edge devices, such as firewalls and VPN gateways. It aggregates authentication failures and denied connection attempts by source IP address. The rule differentiates between brute force attacks, characterized by a high volume of failed attempts against one or more users from a single source, and password spraying, indicated by multiple unique usernames failing authentication from the same source.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
Detects repeated SSH authentication failures originating from an external source on port 22, where the username pattern appears to be programmatically generated or enumerated (e.g., username followed by digits). This behavior is characteristic of automated brute-force attempts targeting common SSH services.
This rule detects potential exploitation attempts targeting the CAPWAP (Control and Provisioning of Wireless Access Points) protocol in FortiOS or FortiSwitchManager. The rule identifies suspicious UDP traffic on port 5246 containing an oversized payload (greater than 1400 bytes), which is characteristic of the exploitation pattern for CVE-2025-25249.
Detects the execution of a Node.js interpreter (node.exe or node) as a child process of a Fortinet management-related process, or where the command line contains references to Fortinet. This behavior is indicative of post-exploitation activity related to CVE-2025-25249, where a heap-based buffer overflow is exploited to deploy the PivotC2 remote access trojan.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
This rule monitors network device logs for patterns indicative of reconnaissance or vulnerability scanning against management and VPN interfaces of common firewall and network appliances (FortiGate, Meraki, WatchGuard, Sophos). It flags sources that either request multiple sensitive paths related to system status and configuration or employ known scanning tools (Nmap, masscan, Nuclei, zgrab, curl) in the user-agent string.
Detects the creation of new administrator accounts or super_admin profiles on network devices such as firewalls from Fortinet, Cisco, Meraki, WatchGuard, and Sophos. This rule monitors log messages indicating administrative account provisioning, which is a potential indicator of unauthorized account manipulation or persistence attempts.
Detects bulk or frequent modifications to firewall policies across various network vendor devices, including Fortinet, Cisco Meraki, WatchGuard, and Sophos. The rule identifies high volumes of policy changes within a 15-minute window or logs summary counts to highlight potentially unauthorized administrative activity.
This rule detects potential brute force activity against network infrastructure devices (firewalls/UTMs). It identifies a sequence where a specific Source IP records multiple failed authentication attempts within a 1-hour window, followed by a successful authentication attempt from the same IP address. This pattern suggests a successful compromise of an account via credential guessing.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects an abnormally high volume of configuration changes (15 or more within a 10-minute window) occurring on network appliances such as firewalls or security gateways, originated by a single source user or IP address. This behavior may indicate unauthorized administrative activity, mass policy updates, or malicious tampering.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects the creation or modification of Network Address Translation (NAT) rules, port forwarding settings, or virtual IP configurations across various enterprise firewall vendors. This could indicate an adversary attempting to establish persistent inbound access to an internal network segment, bypass network egress controls, or perform reconnaissance on accessible services.
Page 2 of 14