Detect execution or file creation of FortigateSniffer binaries associated with the FortiBleed campaign

Ankit Mehta@Secvyn

•updated Jun 23, 2026•6•0•3

This rule detects the presence and execution of known FortiBleed malware components based on their filenames and SHA256 hashes. It monitors both process creation events and file events to identify the malware.