Fortinet FortiClient EMS SQL Injection Exploitation (CVE-2026-21643)

let SQLInjectionPatterns = dynamic(["' OR ", "' AND ", "UNION SELECT", "1=1", "xp_cmdshell", "EXEC(", "CAST(", "CONVERT(", "WAITFOR DELAY", "SLEEP(", "--", "/*", "*/", "DROP TABLE", "INSERT INTO", "UPDATE SET", "DELETE FROM"]);
let FortiClientEMSPorts = dynamic([443, 8013, 8014]);
union
(
  CommonSecurityLog
  | where DeviceVendor =~ "Fortinet" and DeviceProduct =~ "FortiClient EMS"
  | where Message has_any (SQLInjectionPatterns)
  | extend ParsedMessage = Message
  | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Message, DeviceVendor, DeviceProduct, Activity
  | extend DetectionSource = "FortiClient EMS Log"
),
(
  W3CIISLog
  | where csHost has_any ("ems", "forticlient")
  | where csUriStem has_any (SQLInjectionPatterns) or csUriQuery has_any (SQLInjectionPatterns)
  | project TimeGenerated, cIP, csHost, csUriStem, csUriQuery, scStatus, csUserAgent
  | extend DetectionSource = "IIS Web Log"
),
(
  Event
  | where Source == "MSSQLSERVER" or Source == "MSSQL$"
  | where EventID in (18456, 8152, 208, 207, 102)
  | where RenderedDescription has_any (SQLInjectionPatterns)
  | project TimeGenerated, Computer, Source, EventID, RenderedDescription
  | extend DetectionSource = "MSSQL Error Log"
)
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP = coalesce(SourceIP, cIP, Computer), DetectionSource
| where Count >= 1
| extend Severity = "High", CVE = "CVE-2026-21643"

index=* (sourcetype="forticlient:ems" OR sourcetype="iis" OR sourcetype="wineventlog:application" OR source="*forticlient*")
| eval sql_injection_indicators=if(
    match(coalesce(_raw, ""), "(?i)(\' OR |\' AND |UNION SELECT|1=1|xp_cmdshell|EXEC\(|CAST\(|CONVERT\(|WAITFOR DELAY|SLEEP\(|DROP TABLE|INSERT INTO|--|\/\*)"),
    1, 0
  )
| where sql_injection_indicators=1
| eval source_ip=coalesce(src_ip, c_ip, src, "unknown")
| eval target_host=coalesce(dest_host, host, cs_host, "unknown")
| eval detection_source=case(
    sourcetype=="forticlient:ems", "FortiClient EMS Log",
    sourcetype=="iis", "IIS Web Log",
    sourcetype=="wineventlog:application", "Windows Application Event",
    true(), "Other"
  )
| stats count as attempt_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(detection_source) as sources by source_ip, target_host
| eval cve="CVE-2026-21643", severity="critical", vendor="Fortinet", product="FortiClient EMS"
| where attempt_count >= 1
| sort - attempt_count

sequence by source.ip with maxspan=5m
  [network where destination.port in (443, 8013, 8014) and
   (
     url.query : ("*' OR*", "*UNION SELECT*", "*xp_cmdshell*", "*WAITFOR DELAY*", "*1=1*", "*--*") or
     url.path : ("*' OR*", "*UNION SELECT*", "*xp_cmdshell*")
   )
  ]
  [network where destination.port in (443, 8013, 8014) and
   network.bytes_sent > 1000
  ]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "eventCount" AS attempt_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  (
    logsourcetypename(devicetype) ILIKE '%fortinet%'
    OR logsourcetypename(devicetype) ILIKE '%forticlient%'
    OR destinationport IN (443, 8013, 8014)
  )
  AND (
    URL ILIKE '%'' OR %'
    OR URL ILIKE '%UNION SELECT%'
    OR URL ILIKE '%xp_cmdshell%'
    OR URL ILIKE '%WAITFOR DELAY%'
    OR URL ILIKE '%SLEEP(%'
    OR URL ILIKE '%1=1%'
    OR URL ILIKE '%DROP TABLE%'
    OR "utf8(payload)" ILIKE '%xp_cmdshell%'
    OR "utf8(payload)" ILIKE '%UNION SELECT%'
  )
  AND LOGSOURCETIME(devicetime) > NOW() - 1 HOURS
GROUP BY sourceip, destinationip, destinationport, URL, username, logsourceid
ORDER BY attempt_count DESC
LAST 1 HOURS

_sourceCategory=fortinet OR _sourceCategory=forticlient OR _sourceCategory=iis
| where _raw matches /(?i)(union\s+select|xp_cmdshell|waitfor\s+delay|sleep\s*\(|'\s*or\s+|'\s*and\s+|1\s*=\s*1|drop\s+table|exec\s*\()/
| parse regex field=_raw "(?P<src_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b)" nodrop
| parse regex field=_raw "(?P<sql_pattern>(?i)union select|xp_cmdshell|waitfor delay|sleep\(|' OR |1=1)" nodrop
| count by src_ip, sql_pattern, _sourceCategory
| sort by _count desc
| where _count >= 1
| fields src_ip, sql_pattern, _sourceCategory, _count

rule fortinet_forticlient_ems_sqli_cve_2026_21643 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects SQL injection attempts targeting Fortinet FortiClient EMS (CVE-2026-21643)"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2026-21643"
    mitre_attack = "T1190"
    reference = "https://fortiguard.fortinet.com/psirt/FG-IR-25-1142"

  events:
    (
      $e.metadata.event_type = "NETWORK_HTTP" or
      $e.metadata.event_type = "NETWORK_CONNECTION"
    )
    (
      re.regex($e.network.http.request_url, `(?i)(union\s+select|xp_cmdshell|waitfor\s+delay|sleep\s*\(|'\s*or\s+1\s*=\s*1|drop\s+table|exec\s*\(|cast\s*\(|convert\s*\()`) or
      re.regex($e.network.http.request_body, `(?i)(union\s+select|xp_cmdshell|waitfor\s+delay|sleep\s*\(|'\s*or\s+1\s*=\s*1|drop\s+table|exec\s*\()`) or
      re.regex($e.target.application, `(?i)(forticlient|fortiems)`)
    )
    $e.target.port in (443, 8013, 8014)
    $src_ip = $e.principal.ip

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4
| src_ip_address != "127.0.0.1"
| LocalPort in (443, 8013, 8014)
| join(
    #event_simpleName=ProcessRollup2
    | ImageFileName = "/FortiClient*" OR ImageFileName = "*EMS*" OR CommandLine = "*forticlient*"
    | fields aid, ContextProcessId, CommandLine, ImageFileName
  , field=[aid]
  )
| #event_simpleName=DnsRequest
  OR #event_simpleName=NetworkConnectIP4
| RemotePort in (1433, 3306, 5432)
| fields timestamp, aid, src_ip_address, LocalPort, RemotePort, ImageFileName, CommandLine
| eval sqli_context=if(match(CommandLine, "(?i)(sqlcmd|osql|xp_cmdshell|bcp |isql)"), "DB Command Execution", "Network Connection")
| stats count() as connection_count, values(sqli_context) as contexts by aid, src_ip_address, RemotePort
| where connection_count >= 1