Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
Detects network connections to hardcoded threat-actor IPs used by the VPN Go extensions for clipboard exfiltration (/html/continue.php) and proxy-location retrieval (/locations). Covers Chrome 1.1-1.3 and Firefox 1.3.3-1.3.4 infrastructure.
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
This rule detects multiple executions of 'netsh firewall' commands within a one-hour window on a single computer. This activity can indicate an adversary attempting to modify or disable system firewalls to bypass security controls, enable C2 communications, or facilitate lateral movement.
Detects suspicious HTTP requests and API activity targeting Fortinet devices, specifically matching patterns associated with known vulnerabilities like CVE-2022-40684 and CVE-2024-21762. The rule monitors for unauthorized REST API calls, attempts to interact with sensitive administrative endpoints, and patterns indicating potential authentication bypass or remote code execution attempts on FortiGate, FortiOS, and FortiProxy appliances.
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
Detects SSH, SFTP, or SCP connections originating from internal edge appliances such as pfSense firewalls or Synology NAS devices directed at internal network hosts. This activity is consistent with VerdantBamboo BRICKSTORM lateral movement, where compromised edge infrastructure is leveraged as a pivot point to gain access to the internal network.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
This rule detects potential exploitation of Palo Alto PAN-OS vulnerabilities. It monitors for unusual inbound network traffic on ports 6081/6082 from non-RFC1918 (external) IP addresses and identifies specific user-agent strings associated with observed exploit attempts in the wild.
Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.
Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.
Detects outbound TCP traffic destined for known Tor relay ports (9001 and 9030) originating from internal RFC 1918 address space. This behavior is indicative of compromised edge devices or IoT hardware attempting to establish command and control (C2) communication via the Tor network, a tactic commonly used by threat actors to obfuscate their infrastructure and C2 traffic.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects attempts to disable or flush system firewall rules on Linux platforms using common tools like iptables, ufw, firewalld, and nftables. Adversaries often perform these actions to bypass network controls and facilitate unauthorized communication.
Detects suspicious command-line activity indicative of an adversary attempting to disable security controls (such as SELinux, AppArmor, UFW, and IPTables) or performing cleanup and maintenance tasks on suspected cryptominer-related files on a Linux system.
Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.
Page 8 of 17