Search and filter across all detection sources
2,945 rules
New Okta User Created
Detects new user account creation
FortiManager File Download
Download of a file on FortiManager
FortiManager FlatUI Login Success
Login Success via FlatUI on FortiManager
FortiManager FlatUI Upload Success
Upload Success via FlatUI on FortiManager
FortiManager Logout
User logout from FortiManager
FortiManager WebSocket Connection
A WebSocket connection successfully opened on FortiManager
FortiManager Low-privilege User Login Success
Successful login from a low-privilege user to FortiManager
Failed Code Integrity Checks
Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.
Suspicious High IntegrityLevel Conhost Legacy Option
ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
File and Directory Discovery - Linux
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
System Network Discovery - macOS
Detects enumeration of local network configuration
Locked Workstation
Detects locked workstation session events that occur automatically after a standard period of inactivity.
New PowerShell Instance Created
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost
Windows Defender Malware Detection History Deletion
Windows Defender logs when the history of detected infections is deleted.
Windows Update Error
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
New Application in AppCompat
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.