Potential CVE-2023-27997 Exploitation Indicators

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•52

This rule detects indicators of potential exploitation of CVE-2023-27997, a critical Fortigate SSL VPN vulnerability. It specifically looks for GET or POST requests to '/remote/hostcheck_validate' or '/remote/logincheck' URIs that also contain the 'enc=' parameter in the query string. These patterns are associated with attempts to exploit the vulnerability.