Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
This rule aggregates Zscaler Internet Access (ZIA) logs to identify users with Data Loss Prevention (DLP) violations. It calculates the frequency of incidents and flags high-activity users for potential data exfiltration analysis.
Detects FortiGate web-filter events where access to selected high-risk or security-relevant FortiGuard categories was not blocked. The monitored categories include malicious websites, phishing, spam URLs, Dynamic DNS, peer-to-peer file sharing, and crypto-mining destinations. The event should be investigated according to the specific category and destination context.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).
This rule detects the deletion of Google Cloud Platform (GCP) network firewall rules. It monitors GCP audit logs for 'v1.compute.firewalls.delete' or 'beta.compute.firewalls.delete' actions. The rule categorizes the actor (human vs. service account) and identifies if the deletion originated from Terraform, providing context on whether the action was likely an automated infrastructure-as-code change or manual intervention.
This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).
Detects unusually large outbound data transfers (over 500MB) that may indicate data exfiltration preceding Chaos ransomware deployment, consistent with STAC4749 incidents where data was likely stolen before encryption.
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
Detects unusually large outbound data transfers (over 500MB) that may indicate data exfiltration preceding Chaos ransomware deployment, consistent with STAC4749 incidents where data was likely stolen before encryption.
Detects unusually large outbound data transfers (over 500MB) that may indicate data exfiltration preceding Chaos ransomware deployment, consistent with STAC4749 incidents where data was likely stolen before encryption.
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
This rule monitors Palo Alto Networks firewalls for files identified as malicious by the WildFire or ML-based threat detection engines. It filters out known allowed file hashes and aggregates events to provide a high-confidence alert. The rule categorizes threats based on the verdict ('malicious', 'malware', 'phishing', 'suspicious', 'c2') and distinguishes whether the threat was blocked or delivered to the network, providing context for incident response.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
Detects indicators associated with CVE-2025-2492 or AiCloud activity in security logs.
Detects potential exploitation attempts of CVE-2026-35616 targeting Fortinet FortiClient EMS versions 7.4.5 and 7.4.6. The rule identifies suspicious indicators such as API authentication bypass attempts marked by missing certificate headers, unauthorized modifications to remote access VPN profiles, and unauthenticated administrative API access on port 8013.
Page 7 of 17