Synacktiv high experimental sigma

CVE-2024-23666 - FortiManager Configuration Download By Low-Privilege User

Download by a low-privilege user of the full FortiManager system configuration containing information about all ADOM and managed equipments

View Source

Detection Logic

{
  "type": "temporal",
  "rules": [
    "be1e0ec6-9cf8-49ba-aec0-fe380c74a23b",
    "f4f2111e-ff70-4b1b-a452-fce8632df20e",
    "c8bb72aa-6c3f-4c3c-8fa4-8a5ca9cb539a",
    "47f9e063-3cc4-4063-905d-f9f4e8022b85",
    "f9ad0b85-671b-4d1f-aa23-7aa5ff8f9ed1",
    "3843ccf3-75c2-49b7-83d1-17b5d3b4967d"
  ],
  "timespan": "10m"
}

False Positives

  • ⚠ Legitimate administrative actions by high-privilege users not in the filter

Field Validations

Loading…

Comments (0)

Loading comments...