FortigateSniffer packet capture abuse via diagnose sniffer packet

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•7

Detects the execution of the FortigateSniffer binary or the use of the 'diagnose sniffer packet' command on FortiGate devices, which are used to passively intercept network traffic including authentication protocols like RADIUS, NTLM, and Kerberos.