Sagan critical stable other

[FORTINET] Malicious File Detected

[FORTINET] Malicious File Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[FORTINET] Malicious File Detected"; content:"trigger=Default-Malicious-File-Detection-By-"; content:!"action=
| 22
| blocked
| 22
| "; reference:url,https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/ef4bde1e-412e-11ee-8e6d-fa163e15d75b/FortiAnalyzer-7.4.1-Administration_Guide.pdf; parse_src_ip:2; content:"- - - -"; classtype:trojan-activity; sid:5017304; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...