Every published rule

This rule detects anomalous DNS queries known from Cobalt Strike beacons

This rule detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.

This rule detects clear command history in network OS which is used for defense evasion

This rule detects this detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

This rule detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

This rule detects the use of the spoolss named pipe over SMB. This can be leveraged to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

This rule detects clients that may be performing DNS lookups linked with common currency mining pools.

This rule detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

This rule detects anomalous DNS queries to Monero mining pools

This rule detects transferring files with well-known filenames (sensitive files with credential data) using network shares

This rule detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

This rule detects DNS queries containing patterns linked with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this method to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where threat actors manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

This rule detects a system being shutdown or put into different boot mode