[FORTINET] UTM Multiple Webfilter Events Detect from a Single Source [250/1]
SAGAN detection rule by quadrantsec · GPL-2.0
alert any $HOME_NET any -> $HOME_NET any (msg:"[FORTINET] UTM Multiple Webfilter Events Detect from a Single Source [250/1]"; json_content: ".type", "utm"; json_content: ".subtype", "webfilter"; json_meta_content:".catdesc", File|20|Sharing|20|and|20|Storage,Remote|20|Access,Child|20|Sexual|20|Abuse,Crypto|20|Mining,Hacking,Terrorism,Potentially|20|Unwanted|20|Program,Dynamic|20|DNS,Malicious|20|Websites,Newly|20|Observed|20|Domain,Newly|20|Registered|20|Domain,Phishing,Spam|20|URLs,Unrated,Not|20|Rated; json_meta_content: !".catdesc",Advertising,Freeware,Meaningless,File|20|Sharing,Instant|20|Messaging; json_pcre: ".srcip", "/((10\.(\d{1,3}\.){2}\d{1,3})|(172\.(1[6-9]|2[0-9]|3[0-2])(\.\d{1,3}){2})|(192\.168(\.\d{1,3}){2}))/"; json_pcre: ".dstip", "/(!(10\.(\d{1,3}\.){2}\d{1,3})|(172\.(1[6-9]|2[0-9]|3[0-2])(\.\d{1,3}){2})|(192\.168(\.\d{1,3}){2}))/"; json_content: !".eventtype", "ftgd_allow"; json_meta_content:!".crlevel", low,medium; json_content:!".severity", "low"; json_meta_content:!".level", notice,information; content:!".tiktokv.com"; content:!".tiktokcdn-us.com"; content:!"Microsoft-WebDAV-MiniRedir"; content: !"Microsoft-Delivery-Optimization"; meta_content: !"%sagan%",|2e|gov,|2e|edu|2e|local,collector|2e|azure|2e|microsoft|2e|scloud; content:!".live.net"; content:!"oneclient.sfx.ms"; content:!".delivery.mp.microsoft.com"; content:!"icloud.com"; after:track by_src,count 250, seconds 7200; threshold:type suppress, track by_src, count 1, seconds 86400; json_map: "src_ip", ".srcip"; json_map: "dest_ip", ".dstip"; classtype:system-event; reference:url,https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/efa7b0eb-45bc-11ee-8e6d-fa163e15d75b/FortiOS_7.4.1_Log_Reference.pdf; sid:5014487; rev:5; metadata:updated_at 2024_06_05;)