Rule History

alert tcp any any -> $HOME_NET 7900 (msg:"ET EXPLOIT Fortinet FortiSIEM Unauthenticated phMonitor Command Injection (CVE-2025-25256)"; flow:established,to_server; content:"|5a 00 00 00|"; startswith; content:"|3c|archive_nfs_archive_dir|3e|"; fast_pattern; pcre:"/^[^\x3e]*?(?:[\x3b\x24\x2\x60\x7c]|\x25(?:3[bB]|2[46]|60|7[cC]))/R"; reference:url,labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/; reference:cve,2025-25256; classtype:attempted-user; sid:2064027; rev:1; metadata:affected_product FortiSIEM, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2025_08_15, cve CVE_2025_25256, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_15; target:dest_ip;)