FortiBleed Related Network Activity

nomit vyas@xoxo

•updated Jun 24, 2026•4•0•16

This rule detects network connections to known IP addresses associated with FortiBleed activity, categorizing them by their suspected role (e.g., C2, pentest lab, credential validation, sniffer node). It monitors both successful connections and connection attempts.