FortiSIEM gRPC arbitrary file write followed by cron-spawned child process

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•1

Detects a sequence where a FortiSIEM-related process writes or modifies a shell script in a cron or phoenix directory, followed closely within 2 minutes by a child process spawned by cron executing that same written script file.