Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,004 detections
Filters
Last updated
All Time
Detection languages
734
639
208
129
126
Contributors
374
315
226
187
119
Categories
564
419
368
284
263
Platforms
1,427
228
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
2,004
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects the execution of NetExec (formerly CrackMapExec) binaries, associated named pipe creation, and suspicious bursts of authentication activity indicating potential lateral movement or password spraying attacks.
Threat hunting query designed to identify suspicious FortiGate SSL-VPN and administrative authentication activity that may indicate credential abuse following the FortiBleed 2026 credential exposure campaign.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This rule detects anomalous RDP (Logon Type 10) sessions occurring outside of typical business hours or from previously unseen geographic locations, followed closely by the execution of system discovery commands (net.exe, ipconfig.exe, whoami.exe, systeminfo.exe) within a 10-minute window. This behavior is indicative of post-exploitation reconnaissance following an unauthorized or suspicious remote access session.
Detects the spawning of common command-line shells (cmd.exe, powershell.exe, net.exe) by the Windows Remote Management (WinRM) process, wsmprovhost.exe. This activity is indicative of lateral movement or remote command execution via WinRM.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
This rule detects the use of 'net.exe' or 'net1.exe' to configure a non-standard SMB port, which is a technique often used for NTLM reflection and relay attacks. By specifying an arbitrary port for SMB traffic, an attacker may attempt to bypass standard network filtering or establish a listener to intercept authentication requests.
Detects network exploitation attempts targeting the SMBv1 protocol using the EternalBlue vulnerability (MS17-010). This vulnerability was famously exploited by the WannaCry and NotPetya ransomware to propagate across networks.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
This rule detects potential lateral movement attempts using DCOM-based WMI calls to the remote OXID Resolver on port 135. Attackers often abuse DCOM to remotely trigger WMI methods, enabling remote code execution, discovery, or other malicious activities. The rule triggers on the characteristic DCOM OXID Resolve packet structure associated with this activity.
Detects the use of package management tools (pip, npm, yarn) to install packages when initiated by common scripting interpreters or shells (python, cmd, powershell) in environments likely associated with CI/CD pipelines or automated workflows. The rule intentionally excludes jupyter and ipython interactive environments, suggesting it targets non-interactive or automated deployments.
Detects the presence of the 'PSEXESVC' named pipe activity over SMB, which is a hallmark indicator of the PsExec tool being used to facilitate remote execution and lateral movement.
Page 10 of 96