Sigma detection rules, expert-reviewed

FortiGate: Local User Added via CLI Event

Alerts on FortiGate events where a new local user is added under user.local.

FortiGate: Alert on Added Firewall Policy via Event Log

Flags FortiGate events where a firewall policy is added (action Add on firewall.policy).

FortiGate Firewall Address Object Added (event action Add)

Alerts when a FortiGate firewall address object is added via configuration change events.

FortiGate: Administrator Account Added via system.admin Events

Alerts on FortiGate events that add a new administrator account in system.admin.

Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing

Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.

Zeek HTTP Requests to Low Reputation TLDs or Suspicious File Extensions

Alerts on Zeek HTTP requests to low-reputation TLDs or URIs/MIME types consistent with executable payload delivery.

Juniper BGP Logs: Missing MD5 Digest in Route Authentication

Flags Juniper BGP log messages indicating a missing MD5 digest, highlighting potential exposure from unauthenticated routing sessions.

Huawei BGP Authentication Failures Indicating Failed Session Attempts

Flags Huawei BGP authentication failure log events that may indicate credential attempts or routing manipulation.

Cisco LDP MD5 Authentication Failure Events

Flags Cisco LDP TCP MD5 authentication failure events that may indicate brute-force attempts to affect MPLS label signaling.

Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks

Flags Cisco BGP authentication failure events associated with TCP/179 traffic that may indicate credential abuse.

Detect DNS Queries to OAST Callback and Interaction Service Domains

Detects DNS lookups to common OAST/callback domains that may indicate SSRF-style or blind vulnerability validation.

Zeek DNS: Detect NKN Seed Domain Queries

Alerts on Zeek DNS queries containing "seed" and ending with .nkn.org, a pattern consistent with NKN network activity.

DNS Queries for Monero Mining Pool Domains

Alerts on DNS queries to known Monero mining pool domains that may indicate cryptomining activity.

Zeek DNS Queries Ending in Known Crypto Mining Pool Domains

Alert on Zeek DNS queries ending in mining-pool-related domains, excluding local/rejected answers.

Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use

Flags Zeek DCE/RPC calls with operation names starting "efs" that may indicate suspicious EFS RPC usage.