Fortinet FortiOS Sensitive Information Exposure (CVE-2025-68686)

// Detect anomalous access patterns to FortiOS management interfaces preceding suspected information disclosure
let lookback = 1d;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor has "Fortinet"
| where DeviceEventClassID has_any ("admin", "webadmin", "sslvpn", "management")
| where Activity has_any ("login", "config", "get", "download", "backup")
| summarize RequestCount = count(), Activities = make_set(Activity), Users = make_set(SourceUserName) by SourceIP, DestinationIP, DeviceProduct, bin(TimeGenerated, 1h)
| where RequestCount > 20
| project TimeGenerated, SourceIP, DestinationIP, DeviceProduct, RequestCount, Activities, Users
| order by RequestCount desc

index=network_firewall sourcetype=fortinet:fortigate
| eval mgmt_action=case(match(_raw,"(?i)login"),"login", match(_raw,"(?i)config"),"config", match(_raw,"(?i)backup"),"backup", match(_raw,"(?i)download"),"download", 1=1,"other")
| where mgmt_action!="other"
| bin _time span=1h
| stats count as request_count values(mgmt_action) as actions dc(user) as unique_users by src_ip, dest_ip, _time
| where request_count > 20
| sort - request_count

sequence by source.ip with maxspan=1h
  [network where destination.port in (443, 4443) and network.protocol == "http" and http.request.method in ("GET", "POST") and url.path : ("*api*", "*cgi-bin*", "*cmdb*")]
  [network where destination.port in (443, 4443) and http.response.status_code == 200 and network.bytes > 5000]

SELECT sourceip, destinationip, "Device Type", COUNT(*) as eventCount, UNIQUECOUNT("Event Name") as uniqueEvents
FROM events
WHERE "Device Type" ILIKE '%fortios%' OR "Device Type" ILIKE '%fortigate%'
AND ("Event Name" ILIKE '%admin%' OR "Event Name" ILIKE '%config%' OR "Event Name" ILIKE '%backup%')
GROUP BY sourceip, destinationip, "Device Type"
HAVING eventCount > 20
LAST 24 HOURS

_sourceCategory=fortios/firewall
| parse "* * *" as src_ip, dest_ip, action
| where action matches "*admin*" or action matches "*config*" or action matches "*backup*"
| timeslice 1h
| count as request_count by src_ip, dest_ip, _timeslice
| where request_count > 20
| sort by request_count desc

rule fortios_sensitive_info_exposure_cve_2025_68686 {
  meta:
    author = "detection-engineering"
    description = "Detects anomalous FortiOS management access consistent with CVE-2025-68686 exploitation"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.hostname = /(?i)fortigate|fortios/
    $e.network.http.method = "GET" or $e.network.http.method = "POST"
    $e.target.url = /(?i)(api|cmdb|cgi-bin)/
    $e.network.http.response_code = 200
  match:
    $src_ip over 1h
  condition:
    $e and #e > 20
}

#event_simpleName=NetworkConnectIP4
| RemotePort in (443, 4443)
| ContextProcessId=*
| join(query={#event_simpleName=DnsRequest OR #event_simpleName=HttpRequest}, field=aid, key=aid)
| match(field=["Url"], regex="(?i)(api|cmdb|cgi-bin)")
| groupBy([aid, RemoteAddressIP4], function=count(as=request_count))
| test(request_count > 20)