Detect Fortinet Multiple Products Improper Verification of Cryptographic Signature (CVE-2025-59718) in Microsoft Sentinel
Detects exploitation of CVE-2025-59718, an improper verification of cryptographic signature vulnerability (CWE-347) affecting multiple Fortinet products. This vulnerability, listed in CISA's Known Exploited Vulnerabilities catalog, allows attackers to bypass signature validation checks, potentially enabling unsigned firmware/software installation, man-in-the-middle attacks on update channels, or code execution with elevated privileges on affected Fortinet appliances.
MITRE ATT&CK
KQL Detection Query
let FortinetManagementIPs = dynamic([]);
let SuspiciousFirmwareKeywords = dynamic(['unsigned', 'signature', 'bypass', 'invalid cert', 'certificate error', 'verification failed', 'sig check']);
union
(
CommonSecurityLog
| where DeviceVendor =~ "Fortinet"
| where DeviceEventClassID has_any ("update", "firmware", "upgrade", "install")
| where Message has_any (SuspiciousFirmwareKeywords)
| extend EventType = "FirmwareUpdateAnomaly"
),
(
Syslog
| where ProcessName has_any ("fortigate", "fortios", "fortid", "fgd", "fnbamd")
| where SyslogMessage has_any (SuspiciousFirmwareKeywords)
| extend EventType = "SyslogSignatureBypass"
),
(
AzureNetworkAnalytics_CL
| where SrcIP_s in (FortinetManagementIPs) or DestIP_s in (FortinetManagementIPs)
| where L7Protocol_s in~ ("https", "http")
| where DestPort_d in (80, 443, 8443)
| where FlowStatus_s !~ "Allowed"
| extend EventType = "FortinetNetworkAnomaly"
)
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by EventType, Computer, SourceIP=coalesce(SourceIP, SrcIP_s), DeviceVendor
| where Count > 1
| extend AlertSeverity = "High"
| project-reorder LastSeen, EventType, Computer, SourceIP, Count, AlertSeverityDetects anomalous firmware/software update events on Fortinet devices where cryptographic signature verification may have failed or been bypassed, as well as suspicious syslog messages from Fortinet processes indicating signature check failures.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate firmware upgrades on Fortinet appliances that generate verbose logging about signature checks
- Internal vulnerability scanners probing Fortinet management interfaces
- Network monitoring tools generating signature-related log noise during routine health checks
Other platforms for CVE-2025-59718
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Fortinet Firmware Signature Bypass via Invalid Update Request
Expected signal: HTTP 400 or 403 response from Fortinet API with error body referencing signature validation failure; corresponding event in Fortinet system logs with type=event subtype=update level=alert
- Test 2Fortinet Management Interface Signature-Related Error Log Injection Test
Expected signal: Three syslog events appearing in SIEM with Fortinet device name, event type 'update' or 'system', and messages containing 'signature verification failed', 'cert verification failed', and 'unsigned firmware'
- Test 3Network-Level Simulation of Fortinet Update Channel Interception
Expected signal: Network flow logs showing Fortinet appliance connecting to update server via proxy; Fortinet logs showing certificate validation errors or signature failures when intercepted responses are presented
Unlock Pro Content
Get the full detection package for CVE-2025-59718 including response playbook, investigation guide, and atomic red team tests.