Sagan unknown stable other

[FORTINET] Filesystem write violation (LOG_ID_SYS_SECURITY_WRITE_VIOLATION)

[FORTINET] Filesystem write violation (LOG_ID_SYS_SECURITY_WRITE_VIOLATION)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[FORTINET] Filesystem write violation (LOG_ID_SYS_SECURITY_WRITE_VIOLATION)"; content:"20230
| 22 20
| type="; content:"subtype=
| 22
| system
| 22
| "; reference:url,docs.fortinet.com/document/fortigate/7.4.0/new-features/226732/real-time-file-system-integrity-checking; content:!"- - - -"; classtype:malware; sid:5013790; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...