Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
229 detections
Filters
Last updated
All Time
Detection languages
98
76
22
16
7
Contributors
67
65
42
13
8
Categories
104
61
51
44
34
Platforms
39,894
7,228
6,523
3,864
3,624
229
Products / Services
81
66
63
51
21
MITRE Techniques
93
61
42
27
19
CVEs
18
13
11
10
8
IDS Classtypes
48
11
6
5
3
IDS Protocols
33
28
14
Detects successful administrative login events originating from IP addresses outside of configured trusted management networks on Fortinet devices.
Detects command execution patterns on NetScaler appliances involving the extraction of system details (id, uname, hostname, nsrelease) and writing or echoing them into HTML files within NetScaler web directories, indicative of web shell installation or staging.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
This rule detects devices with a BIOS release date older than 730 days (2 years), which could indicate unpatched or outdated firmware posing security and stability risks.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
Detects potential unauthorized or suspicious configuration changes related to packet sniffer objects and associated authentication or management ports on FortiGate firewalls across multiple devices.
This rule monitors for Cisco ASA/FTD device logs indicating an unexpected process crash (e.g., 'crashinfo', 'Traceback', 'decode-CF process restart') in conjunction with logs related to WebVPN activity or malformed HTTP requests. This pattern is indicative of potential exploitation attempts against the Cisco WebVPN service, such as those targeting CVE-2026-20349.
This rule detects anomalous outbound SMTP (port 25) traffic originating from a NetScaler ADC or Gateway appliance. Since these appliances have no legitimate business requirement to initiate outbound SMTP communication, such traffic is a strong indicator of post-compromise activity, potentially used for command and control or data exfiltration.
This rule identifies MikroTik devices running vulnerable versions of RouterOS (specifically those older than 7.24) that are susceptible to CVE-2026-84411. This vulnerability involves an integer underflow in the web management HTTP handling, which can lead to unauthenticated remote code execution or denial of service.
Detects network or system activity associated with the 'p2pwn' backdoor account on Dahua cameras, which is introduced by exploiting the CVE-2024-39943 vulnerability. The rule monitors for the presence of 'p2pwn' and 'p2password' strings across logs, including RPC/login events.
This rule detects potential exploitation attempts targeting the CAPWAP (Control and Provisioning of Wireless Access Points) protocol in FortiOS or FortiSwitchManager. The rule identifies suspicious UDP traffic on port 5246 containing an oversized payload (greater than 1400 bytes), which is characteristic of the exploitation pattern for CVE-2025-25249.
This rule identifies MikroTik devices running vulnerable versions of RouterOS (specifically those older than 7.24) that are susceptible to CVE-2026-84411. This vulnerability involves an integer underflow in the web management HTTP handling, which can lead to unauthenticated remote code execution or denial of service.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
Page 1 of 11