OWN

Threat intelligence driven #cybersecurity.

#Audit #Consulting #CTI #CERT #SOC

[OWN @own_fr]

We released “GW Forensic”, a DFIR tool to collect & analyze logs from Google Workspace environments. Documentation related to TTPs and recommendations to better protect your instance are included.
For more information, take a look at the project: https://t.co/5YawxfOtzB
You can find our GW Forensic tool presentation at #CoRiiN2024 (french version) : https://t.co/JeDqtdbnlH

[OWN @own_fr]

Our log collection tool, Fastir-Forti, makes it possible to collect logs from most FortiGate and FortiWeb instances in order to assess a potential compromise, including:

- Retrieval of administrator accounts present on the instance
- Retrieval of the most recent administrative logs to identify a public SSO login

Take a look at https://t.co/RViz0iRjEF

https://t.co/70RyMR0BiB

[OWN @own_fr]

We are releasing “FastIR-Forti” today, a DFIR tool designed to help analysts collect relevant logs from Fortinet appliances in cases of suspected compromise, using native commands without the need to perform a dump. Discover the project: https://t.co/RViz0iRjEF

More information on our blogpost with technical data: https://t.co/u8S19gn44e

[OWN @own_fr]

#Fortinet #FortiCloud #Vulnerability #DFIR #Hunting

Here are some tips to help identify FortiCloud SSO vulnerability, CVE-2025-59718 and CVE-2025-59719, targeted by multiple actors since the official patch released on the 9th of December by Fortinet.

[OWN @own_fr]

If you collect Fortinet logs within a SIEM or XDR such as @sekoia_io, you can implement a SIGMA detection rule to raise an alert on SSO login behavior originating from a public IP address:

detection:
sso-login:
event.provider: sso
event.action: login
sekoiaio.intake.dialect: fortinet fortigate
internal-login:
sekoiaio.tags.source.ip|contains: rfc1918
condition: sso-login and not internal-login

[OWN @own_fr]

Additionally, our baselines available in the repository for several versions of the equipment are currently being integrated by CIRCL into the HashLookup tool.

[OWN @own_fr]

We are releasing “FastIR-Forti” today, a DFIR tool designed to help analysts collect relevant logs from Fortinet appliances in cases of suspected compromise, using native commands without the need to perform a dump. Discover the project: https://t.co/RViz0iRjEF

More information on our blogpost with technical data: https://t.co/u8S19gn44e

[OWN @own_fr]

Currently compatible with FortiGate, FortiWeb, and FortiADC, it makes it easy, for example, to identify exploitation of the latest FortiWeb CVE-2025-25257 and the recent path confusion issue FG-IR-25-910 described below. https://t.co/EhJa1wOBab

[OWN @own_fr]

Critical FortiWeb vulnerability, here we go again!

Open the thread to discover the vulnerability and how to detect and response!

#Vulnerabiliy #Analysis #DFIR

[OWN @own_fr]

IoCs (large exploit)
- 89.169.55[.]168
- 107.152.41[.]19
- Malicious accounts name : Testpoint / trader / trader1

[OWN @own_fr]

Critical FortiWeb vulnerability, here we go again!

Open the thread to discover the vulnerability and how to detect and response!

#Vulnerabiliy #Analysis #DFIR

[OWN @own_fr]

Another source, which hasn’t been checked for now, is the analysis of Apache web server handling panel administrators' requests where we should be able to see POST request with 200 status code. This requires having access to the disk files by performing a dump. We covered this log source in our latest blog post related to... a previous Fortiweb CVE in August 😊
==> https://t.co/awrlFkANuH