deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: HTTP Request to Low Reputation TLD or Suspicious File Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: @signalblur, Corelight
Date: 2025-02-26
Log source: zeek/

Description:
Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.


Detection logic:
{
  "selection_suspicious_tld": {
    "host|endswith": [
      ".bid",
      ".by",
      ".cf",
      ".click",
      ".cm",
      ".ga",
      ".gq",
      ".ir",
      ".kp",
      ".loan",
      ".ml",
      ".mm",
      ".party",
      ".pw",
      ".ru",
      ".su",
      ".sy",
      ".tk",
      ".top",
      ".tv",
      ".ve",
      ".work",
      ".xyz"
    ]
  },
  "selection_malicious_ext": {
    "uri|endswith": [
      ".bat",
      ".bin",
      ".cmd",
      ".cpl",
      ".dll",
      ".dylib",
      ".elf",
      ".exe",
      ".hta",
      ".iso",
      ".jar",
      ".js",
      ".lnk",
      ".msi",
      ".pif",
      ".ps1",
      ".py",
      ".reg",
      ".scr",
      ".sh",
      ".so",
      ".vbs",
      ".wsf"
    ]
  },
  "selection_malicious_mime": {
    "resp_mime_types": [
      "application/vnd.microsoft.portable-executable",
      "application/x-bat",
      "application/x-dosexec",
      "application/x-elf",
      "application/x-iso9660-image",
      "application/x-java-archive",
      "application/x-ms-shortcut",
      "application/x-msdos-program",
      "application/x-msdownload",
      "application/x-python-code",
      "application/x-sh"
    ]
  },
  "condition": "selection_suspicious_tld and 1 of selection_malicious_*"
}

References:
  - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows
  - https://www.spamhaus.org/reputation-statistics/cctlds/domains/
Sigma Detection Rule: MITRE BZAR Indicators for Persistence
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @neu5ron, SOC Prime
Date: 2020-03-19
ATT&CK techniques: T1547.004
Log source: zeek/

Description:
Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.

Detection logic:
{
  "op1": {
    "endpoint": "spoolss",
    "operation": "RpcAddMonitor"
  },
  "op2": {
    "endpoint": "spoolss",
    "operation": "RpcAddPrintProcessor"
  },
  "op3": {
    "endpoint": "IRemoteWinspool",
    "operation": "RpcAsyncAddMonitor"
  },
  "op4": {
    "endpoint": "IRemoteWinspool",
    "operation": "RpcAsyncAddPrintProcessor"
  },
  "op5": {
    "endpoint": "ISecLogon",
    "operation": "SeclCreateProcessWithLogonW"
  },
  "op6": {
    "endpoint": "ISecLogon",
    "operation": "SeclCreateProcessWithLogonExW"
  },
  "condition": "1 of op*"
}

References:
  - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence
Sigma Detection Rule: Suspicious DNS Z Flag Bit Set
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @neu5ron, SOC Prime Team, Corelight
Date: 2021-05-04
ATT&CK techniques: T1095, T1571
Log source: zeek/

Description:
The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'


Detection logic:
{
  "z_flag_unset": {
    "Z": 0
  },
  "most_probable_valid_domain": {
    "query|contains": "."
  },
  "exclude_tlds": {
    "query|endswith": [
      ".arpa",
      ".local",
      ".ultradns.net",
      ".twtrdns.net",
      ".azuredns-prd.info",
      ".azure-dns.com",
      ".azuredns-ff.info",
      ".azuredns-ff.org",
      ".azuregov-dns.org"
    ]
  },
  "exclude_query_types": {
    "qtype_name": [
      "ns",
      "mx"
    ]
  },
  "exclude_responses": {
    "answers|endswith": "\\\\x00"
  },
  "exclude_netbios": {
    "id.resp_p": [
      137,
      138,
      139
    ]
  },
  "condition": "not z_flag_unset and most_probable_valid_domain and not (exclude_tlds or exclude_query_types or exclude_responses or exclude_netbios)"
}

References:
  - https://twitter.com/neu5ron/status/[PII_REDACTED]02443009
  - https://tdm.socprime.com/tdm/info/eLbyj4JjI15v#sigma
  - https://tools.ietf.org/html/rfc2929#section-2.1
  - https://www.netresec.com/?page=Blog&month=2021-01&post=Finding-Targeted-SUNBURST-Victims-with-pDNS
Sigma Detection Rule: First Time Seen Remote Named Pipe - Zeek
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden, @neu5ron, Tim Shelton
Date: 2020-04-02
ATT&CK techniques: T1021.002
Log source: zeek/

Description:
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Detection logic:
{
  "selection": {
    "path": "\\\\\\\\\\*\\\\IPC$"
  },
  "filter_keywords": [
    "samr",
    "lsarpc",
    "winreg",
    "netlogon",
    "srvsvc",
    "protected_storage",
    "wkssvc",
    "browser",
    "netdfs",
    "svcctl",
    "spoolss",
    "ntsvcs",
    "LSM_API_service",
    "HydraLsPipe",
    "TermSrv_API_service",
    "MsFteWds"
  ],
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/menasec1/status/[PII_REDACTED]87451904
Sigma Detection Rule: Executable from Webdav
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: SOC Prime, Adam Swan
Date: 2020-05-01
ATT&CK techniques: T1105
Log source: zeek/

Description:
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/

Detection logic:
{
  "selection_webdav": [
    {
      "c-useragent|contains": "WebDAV"
    },
    {
      "c-uri|contains": "webdav"
    }
  ],
  "selection_executable": [
    {
      "resp_mime_types|contains": "dosexec"
    },
    {
      "c-uri|endswith": ".exe"
    }
  ],
  "condition": "selection_webdav and selection_executable"
}

References:
  - http://carnal0wnage.attackresearch.com/2012/06/webdav-server-to-download-custom.html
  - https://github.com/OTRF/detection-hackathon-apt29
Sigma Detection Rule: DNS TOR Proxies
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Saw Winn Naung , Azure-Sentinel
Date: 2021-08-15
ATT&CK techniques: T1048
Log source: zeek/

Description:
Identifies IPs performing DNS lookups associated with common Tor proxies.

Detection logic:
{
  "selection": {
    "query|endswith": [
      ".hiddenservice.net",
      ".onion.ca",
      ".onion.cab",
      ".onion.casa",
      ".onion.city",
      ".onion.direct",
      ".onion.dog",
      ".onion.glass",
      ".onion.gq",
      ".onion.guide",
      ".onion.in.net",
      ".onion.ink",
      ".onion.it",
      ".onion.link",
      ".onion.lt",
      ".onion.lu",
      ".onion.ly",
      ".onion.mn",
      ".onion.network",
      ".onion.nu",
      ".onion.pet",
      ".onion.plus",
      ".onion.pt",
      ".onion.pw",
      ".onion.rip",
      ".onion.sh",
      ".onion.si",
      ".onion.to",
      ".onion.top",
      ".onion.ws",
      ".onion",
      ".s1.tor-gateways.de",
      ".s2.tor-gateways.de",
      ".s3.tor-gateways.de",
      ".s4.tor-gateways.de",
      ".s5.tor-gateways.de",
      ".t2w.pw",
      ".tor2web.ae.org",
      ".tor2web.blutmagie.de",
      ".tor2web.com",
      ".tor2web.fi",
      ".tor2web.io",
      ".tor2web.org",
      ".tor2web.xyz",
      ".torlink.co"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
Sigma Detection Rule: Suspicious PsExec Execution - Zeek
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden, @neu5ron, Tim Shelton
Date: 2020-04-02
ATT&CK techniques: T1021.002
Log source: zeek/

Description:
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Detection logic:
{
  "selection": {
    "path|contains|all": [
      "\\\\",
      "\\IPC$"
    ],
    "name|endswith": [
      "-stdin",
      "-stdout",
      "-stderr"
    ]
  },
  "filter": {
    "name|startswith": "PSEXESVC"
  },
  "condition": "selection and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html
Sigma Detection Rule: Remote Task Creation via ATSVC Named Pipe - Zeek
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Samir Bousseaden, @neu5rn
Date: 2020-04-03
ATT&CK techniques: T1053.002
Log source: zeek/

Description:
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Detection logic:
{
  "selection": {
    "path": "\\\\\\*\\IPC$",
    "name": "atsvc"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
Sigma Detection Rule: MITRE BZAR Indicators for Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @neu5ron, SOC Prime
Date: 2020-03-19
ATT&CK techniques: T1047, T1053.002, T1569.002
Log source: zeek/

Description:
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Detection logic:
{
  "op1": {
    "endpoint": "JobAdd",
    "operation": "atsvc"
  },
  "op2": {
    "endpoint": "ITaskSchedulerService",
    "operation": "SchRpcEnableTask"
  },
  "op3": {
    "endpoint": "ITaskSchedulerService",
    "operation": "SchRpcRegisterTask"
  },
  "op4": {
    "endpoint": "ITaskSchedulerService",
    "operation": "SchRpcRun"
  },
  "op5": {
    "endpoint": "IWbemServices",
    "operation": "ExecMethod"
  },
  "op6": {
    "endpoint": "IWbemServices",
    "operation": "ExecMethodAsync"
  },
  "op7": {
    "endpoint": "svcctl",
    "operation": "CreateServiceA"
  },
  "op8": {
    "endpoint": "svcctl",
    "operation": "CreateServiceW"
  },
  "op9": {
    "endpoint": "svcctl",
    "operation": "StartServiceA"
  },
  "op10": {
    "endpoint": "svcctl",
    "operation": "StartServiceW"
  },
  "condition": "1 of op*"
}

References:
  - https://github.com/mitre-attack/bzar#indicators-for-attck-execution
Sigma Detection Rule: Potential PetitPotam Attack Via EFS RPC Calls
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @neu5ron, @Antonlovesdnb, Mike Remen
Date: 2021-08-17
ATT&CK techniques: T1557.001, T1187
Log source: zeek/

Description:
Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
 View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'


Detection logic:
{
  "selection": {
    "operation|startswith": "efs"
  },
  "condition": "selection"
}

References:
  - https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp
  - https://msrc.microsoft.com/update-guide/vulnerability/ADV210003
  - https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf
  - https://threatpost.com/microsoft-petitpotam-poc/168163/
Sigma Detection Rule: Suspicious Access to Sensitive File Extensions - Zeek
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Samir Bousseaden, @neu5ron
Date: 2020-04-02
Log source: zeek/

Description:
Detects known sensitive file extensions via Zeek

Detection logic:
{
  "selection": {
    "name|endswith": [
      ".pst",
      ".ost",
      ".msg",
      ".nst",
      ".oab",
      ".edb",
      ".nsf",
      ".bak",
      ".dmp",
      ".kirbi",
      ".rdp"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: DNS Events Related To Mining Pools
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Saw Winn Naung, Azure-Sentinel, @neu5ron
Date: 2021-08-19
ATT&CK techniques: T1569.002, T1496
Log source: zeek/

Description:
Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Detection logic:
{
  "selection": {
    "query|endswith": [
      "monerohash.com",
      "do-dear.com",
      "xmrminerpro.com",
      "secumine.net",
      "xmrpool.com",
      "minexmr.org",
      "hashanywhere.com",
      "xmrget.com",
      "mininglottery.eu",
      "minergate.com",
      "moriaxmr.com",
      "multipooler.com",
      "moneropools.com",
      "xmrpool.eu",
      "coolmining.club",
      "supportxmr.com",
      "minexmr.com",
      "hashvault.pro",
      "xmrpool.net",
      "crypto-pool.fr",
      "xmr.pt",
      "miner.rocks",
      "walpool.com",
      "herominers.com",
      "gntl.co.uk",
      "semipool.com",
      "coinfoundry.org",
      "cryptoknight.cc",
      "fairhash.org",
      "baikalmine.com",
      "tubepool.xyz",
      "fairpool.xyz",
      "asiapool.io",
      "coinpoolit.webhop.me",
      "nanopool.org",
      "moneropool.com",
      "miner.center",
      "prohash.net",
      "poolto.be",
      "cryptoescrow.eu",
      "monerominers.net",
      "cryptonotepool.org",
      "extrmepool.org",
      "webcoin.me",
      "kippo.eu",
      "hashinvest.ws",
      "monero.farm",
      "linux-repository-updates.com",
      "1gh.com",
      "dwarfpool.com",
      "hash-to-coins.com",
      "pool-proxy.com",
      "hashfor.cash",
      "fairpool.cloud",
      "litecoinpool.org",
      "mineshaft.ml",
      "abcxyz.stream",
      "moneropool.ru",
      "cryptonotepool.org.uk",
      "extremepool.org",
      "extremehash.com",
      "hashinvest.net",
      "unipool.p

References:
  - https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml
Sigma Detection Rule: WebDav Put Request
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1048.003
Log source: zeek/

Description:
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.

Detection logic:
{
  "selection": {
    "user_agent|contains": "WebDAV",
    "method": "PUT"
  },
  "filter": {
    "id.resp_h|cidr": [
      "10.0.0.0/8",
      "127.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/17
Sigma Detection Rule: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-20
ATT&CK techniques: T1557.001, T1187
Log source: zeek/

Description:
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.


Detection logic:
{
  "selection": {
    "query|contains|all": [
      "UWhRCA",
      "BAAAA"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
Sigma Detection Rule: New Kind of Network (NKN) Detection
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Michael Portera (@mportatoes)
Date: 2022-04-21
Log source: zeek/

Description:
NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

Detection logic:
{
  "selection": {
    "query|contains|all": [
      "seed",
      ".nkn.org"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nknorg/nkn-sdk-go
  - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
  - https://github.com/Maka8ka/NGLite
Sigma Detection Rule: Possible Impacket SecretDump Remote Activity - Zeek
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden, @neu5ron
Date: 2020-03-19
ATT&CK techniques: T1003.002, T1003.004, T1003.003
Log source: zeek/

Description:
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Detection logic:
{
  "selection": {
    "path|contains|all": [
      "\\",
      "ADMIN$"
    ],
    "name|contains": "SYSTEM32\\",
    "name|endswith": ".tmp"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
Sigma Detection Rule: Kerberos Network Traffic RC4 Ticket Encryption
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: sigma
Date: 2020-02-12
ATT&CK techniques: T1558.003
Log source: zeek/

Description:
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

Detection logic:
{
  "selection": {
    "request_type": "TGS",
    "cipher": "rc4-hmac"
  },
  "computer_acct": {
    "service|startswith": "$"
  },
  "condition": "selection and not computer_acct"
}

References:
  - https://adsecurity.org/?p=3458
Sigma Detection Rule: FortiGate - New VPN SSL Web Portal Added
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
Date: 2025-11-01
ATT&CK techniques: T1133
Log source: fortigate/

Description:
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.


Detection logic:
{
  "selection": {
    "action": "Add",
    "cfgpath": "vpn.ssl.web.portal"
  },
  "condition": "selection"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
Sigma Detection Rule: FortiGate - Firewall Address Object Added
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
Date: 2025-11-01
ATT&CK techniques: T1685
Log source: fortigate/

Description:
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

Detection logic:
{
  "selection": {
    "action": "Add",
    "cfgpath": "firewall.address"
  },
  "condition": "selection"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
Sigma Detection Rule: FortiGate - VPN SSL Settings Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
Date: 2025-11-01
ATT&CK techniques: T1133
Log source: fortigate/

Description:
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.


Detection logic:
{
  "selection": {
    "action": "Edit",
    "cfgpath": "vpn.ssl.settings"
  },
  "condition": "selection"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr
Sigma Detection Rule: FortiGate - New Administrator Account Created
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
Date: 2025-11-01
ATT&CK techniques: T1136.001
Log source: fortigate/

Description:
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.

Detection logic:
{
  "selection": {
    "action": "Add",
    "cfgpath": "system.admin"
  },
  "condition": "selection"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
Sigma Detection Rule: FortiGate - User Group Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
Date: 2025-11-01
Log source: fortigate/

Description:
Detects the modification of a user group on a Fortinet FortiGate Firewall.
The group could be used to grant VPN access to a network.


Detection logic:
{
  "selection": {
    "action": "Edit",
    "cfgpath": "user.group"
  },
  "condition": "selection"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
Sigma Detection Rule: FortiGate - New Local User Created
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
Date: 2025-11-01
ATT&CK techniques: T1136.001
Log source: fortigate/

Description:
Detects the creation of a new local user on a Fortinet FortiGate Firewall.
The new local user could be used for VPN connections.


Detection logic:
{
  "selection": {
    "action": "Add",
    "cfgpath": "user.local"
  },
  "condition": "selection"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr