FortiWeb CVE-2025-52970 Out-of-Band Authentication Bypass Attempt
Detects potential exploitation attempts against FortiWeb CVE-2025-52970. The detection looks for individual HTTP GET requests to a specific API endpoint with a crafted APSCOOKIE_FWEB cookie containing 'Era=9'. The rule enriches alerts with information about known malicious IPs without strictly filtering on them.
Microsoft Sentinel (KQL)
