FortiSandbox VNC JSON Command Injection Attempt
This rule detects attempts to inject shell metacharacters or command substitution into JSON associated with a 'start vnc' operation within FortiSandbox. It specifically looks for patterns indicative of command injection vulnerabilities in network events, either in the event_sub_type or action_remote_ip fields. The rule aims to identify malicious activity targeting FortiSandbox, potentially leveraging a vulnerability like the one described in FG-IR-26-141.
Cortex XDR
