Every published rule

This rule detects AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

This rule detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

This rule detects wannacry killswitch domain dns queries

This rule detects use of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The use of this RPC function should be rare if ever used at all. Thus use of this function is uncommon enough that any use of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

This rule detects windows DCE-RPC functions which indicate an execution methods on the remote system. All credit for the Zeek mapping of the anomalous endpoint/operation field goes to MITRE

This rule detects modifications to a config that will serve an adversary's impacts or persistence

This rule detects NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

This rule detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in anomalous file extensions (.exe, .dll, .hta), which may indicate hostile activity.

This rule detects collect pertinent data from the configuration files

This rule detects the creation of an administrator account on a Fortinet FortiGate Firewall.

This rule detects ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

This rule detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

This rule detects show when private keys are being exported from the device, or when new certificates are installed

This rule detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

This rule detects see what files are being deleted from flash file systems

This rule detects see what commands are being input into the device by other people, full credentials can be in the history

This rule detects anomalous DNS queries using base64 encoding

This rule detects anomalous DNS queries to api.telegram.org used by Telegram Bots of any kind

This rule detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network.

This rule detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/