FortiBleed Python Script Execution Detection

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the main file executed.