Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
6
5
1
Contributors
8
4
Categories
7
6
5
4
4
Platforms
11
8
3
1
Products / Services
12
5
5
3
3
MITRE Techniques
8
3
3
1
1
CVEs
71
71
64
58
49
IDS Classtypes
5
IDS Protocols
4
1
This rule detects potential exploitation attempts targeting the CAPWAP (Control and Provisioning of Wireless Access Points) protocol in FortiOS or FortiSwitchManager. The rule identifies suspicious UDP traffic on port 5246 containing an oversized payload (greater than 1400 bytes), which is characteristic of the exploitation pattern for CVE-2025-25249.
Detects the execution of a Node.js interpreter (node.exe or node) as a child process of a Fortinet management-related process, or where the command line contains references to Fortinet. This behavior is indicative of post-exploitation activity related to CVE-2025-25249, where a heap-based buffer overflow is exploited to deploy the PivotC2 remote access trojan.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.
This rule identifies vulnerable versions of FortiOS and FortiSwitchManager susceptible to CVE-2025-25249, a critical heap-based buffer overflow vulnerability in the cw_acd daemon. It parses device version strings from security logs and compares them against known affected version ranges.
This rule identifies vulnerable versions of FortiOS and FortiSwitchManager susceptible to CVE-2025-25249, a critical heap-based buffer overflow vulnerability in the cw_acd daemon. It parses device version strings from security logs and compares them against known affected version ranges.
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
This rule identifies vulnerable versions of FortiOS and FortiSwitchManager susceptible to CVE-2025-25249, a critical heap-based buffer overflow vulnerability in the cw_acd daemon. It parses device version strings from security logs and compares them against known affected version ranges.
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.