Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
This rule detects indicators of potential exploitation of CVE-2023-27997, a critical Fortigate SSL VPN vulnerability. It specifically looks for GET or POST requests to '/remote/hostcheck_validate' or '/remote/logincheck' URIs that also contain the 'enc=' parameter in the query string. These patterns are associated with attempts to exploit the vulnerability.
