FortigateSniffer Golang binary intercepting RADIUS/NTLM/Kerberos on FortiGate

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•8

Detects the execution of 'FortiGateSniffer', a tool identified as Golang-based, used to perform passive network packet capture on compromised FortiGate devices. The rule also analyzes captured traffic for sensitive authentication protocols including RADIUS, Kerberos, and NTLM.