[FORTISANDBOX] Malicious File Detected - CatchAll

alert any $HOME_NET any -> $HOME_NET any (msg:"[FORTISANDBOX] Malicious File Detected - CatchAll"; content:"logid=1015000205"; content:"type=malware"; meta_content:"%sagan%", risk=,rating=; content:!"clientname=
| 22
| mx
| 3a
| "; content:!"ftype=
| 22
| WEBLink
| 22
| "; content:!"stype=
| 22
| On-Demand
| 22
| "; content:!"rating=Low"; content:!"risk=
| 22
| Low Risk
| 22
| "; reference:url,fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/dfa8b38e-6e4f-11ec-bdf2-fa163e15d75b/FortiSandbox-4.0.1-Log_Reference.pdf; classtype:malware; sid:5011312; rev:2; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_03_06, updated_at 2025_08_20;)