Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
289 detections
Filters
Last updated
All Time
Detection languages
109
73
41
24
20
Contributors
58
47
46
33
19
Categories
68
66
59
48
40
Platforms
224
51
50
23
10
Products / Services
10,665
9,773
6,704
4,421
3,749
289
MITRE Techniques
69
68
65
54
43
CVEs
12
6
6
6
5
IDS Classtypes
18
3
2
2
1
IDS Protocols
21
2
1
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects high-volume authentication attempts against Fortinet network appliances where multiple distinct source IPs successfully authenticate against multiple distinct accounts matching specific administrative naming patterns. This pattern is indicative of potential credential stuffing or brute-force campaigns targeting edge infrastructure.
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.
Detects command-and-control network traffic associated with the DEV#POPPER (Void Dokkaebi/Contagious Interview) RAT. The rule monitors for characteristic WebSocket heartbeat and notification calls to '/verify-human/' endpoints, data exfiltration requests to '/u/f', and outbound connections to known malicious C2 IP addresses.
Detects network connections, DNS resolutions, or TLS SNI values matching known TWINLOOT command-and-control infrastructure, including the attacker-registered domains sharepointx.th2ch.com and lpi-web.com and the failover IP 193.24.211.221. TWINLOOT is a modular Python implant that hides its C2 inside trusted Microsoft cloud services (Graph API, SharePoint Online, Teams TURN relay) while also relying on dedicated attacker-controlled infrastructure for direct TLS/WebSocket tunneling and failover.
Detects outbound HTTP traffic indicative of pyCodeVx RAT check-in behavior. The rule identifies communication with ddnsfree.com C2 domains or requests containing the 'pyCodeVx' marker in the URL or User-Agent, coupled with a base64-encoded, fixed-format victim/session ID.
Detects instances where users successfully access websites categorized by FortiGuard as 'Artificial Intelligence Technology' without being blocked by the web filtering policy. This rule is intended to support organizational AI governance, data loss prevention, and intellectual property protection policies.
FortiGate Local User Account Created
Cortex XDR
Detects the creation of a new locally defined user account on a FortiGate device by monitoring configuration change logs. Unauthorized local accounts can be used to establish persistent, unauthorized access to network infrastructure.
FortiGate Allowed RDP Connection
Cortex XDR
Detects network traffic identified by FortiGate as Remote Desktop Protocol (RDP) that has been explicitly permitted (Accept action) by the firewall policy. This rule monitors for successful packet flow through the firewall, providing visibility into potential lateral movement paths via RDP.
FortiGate High Memory Usage Alert
Cortex XDR
Detects instances where FortiGate network security appliances report sustained high memory utilization exceeding a defined threshold. Elevated memory usage may indicate performance degradation, excessive traffic volume, or resource-intensive configuration, and can precede entering FortiOS conserve mode.
FortiGate High CPU Utilization Detected
Cortex XDR
Detects FortiGate devices whose average reported CPU utilization exceeds 90 percent during the correlation window. Sustained CPU pressure can degrade firewall throughput, session establishment, inspection performance, and management responsiveness and should be investigated as a device-health condition.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
FortiGate Conserve Mode Activated
Cortex XDR
Detects system events on FortiGate devices indicating that the FortiOS has entered 'conserve mode'. This state occurs when the system experiences high memory pressure, potentially triggering resource-protection mechanisms that can impact traffic processing, security inspection, and overall firewall stability.
Detects FortiGate web-filter events where access to selected high-risk or security-relevant FortiGuard categories was not blocked. The monitored categories include malicious websites, phishing, spam URLs, Dynamic DNS, peer-to-peer file sharing, and crypto-mining destinations. The event should be investigated according to the specific category and destination context.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
Detects a successful FortiCloud SSO administrative login to a Fortinet appliance followed by the creation of a local administrator account from the same source IP and user within 15 minutes.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
This detects a possible VPN brute-force or password-spray followed by successful authentication, where the same user has 5 failed SSL VPN login attempts followed by a successful tunnel-up event within 2 minutes.
Detects anomalous network traffic patterns targeting FortiClient EMS systems, specifically on port 8013. This pattern is indicative of exploitation attempts related to CVE-2026-35616, where an external entity communicates with a vulnerable FortiClient EMS instance multiple times in a short window.
Page 5 of 14