FortiGate Web Logs: Indicators of CVE-2023-27997 Exploitation Attempt

title: "FortiGate Web Logs: Indicators of CVE-2023-27997 Exploitation Attempt"
id: 2846b98e-7366-4484-80c8-f87524bd8318
status: test
description: This rule flags web requests in FortiGate logs that target the /remote/hostcheck_validate or /remote/logincheck endpoints using GET or POST, with query content containing "enc=". Attackers exploiting CVE-2023-27997 may generate these specific request patterns as part of their interaction with the vulnerable functionality. Detection relies on HTTP method, request URI/query fields, and the presence of the "enc=" keyword in the logged web traffic.
references:
  - https://blog.lexfo.fr/Forensics-xortigate-notice.html
  - https://blog.lexfo.fr/xortigate-cve-2023-27997.html
  - https://research.kudelskisecurity.com/2023/06/12/cve-2023-27997-fortigate-ssl-vpn/
  - https://labs.watchtowr.com/xortigate-or-cve-2023-27997/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-27997/web_cve_2023_27997_pre_authentication_rce.yml
author: Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-28
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-27997
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_uri:
    cs-method:
      - GET
      - POST
    cs-uri-query|contains:
      - /remote/hostcheck_validate
      - /remote/logincheck
  selection_keywords:
    - enc=
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 31e4e649-7394-4fd2-9ae7-dbc61eebb550
    type: derived