Synacktiv low experimental sigma

FortiManager Backup Method Call

Call to a backup method through the FlatUI proxy of FortiManager

View Source

Detection Logic

{
  "selection": {
    "cs-method": "GET",
    "cs-uri-stem
| startswith": "/cgi-bin/module/flatui_proxy",
    "cs-uri-query
| contains
| all": [
      "req={",
      "%22url%22:%22/gui/sys/db%22",
      "%22method%22:%22backup%22"
    ],
    "sc-status": 200
  },
  "condition": "selection"
}

Field Validations

Loading…

Comments (0)

Loading comments...