CVE-2025-25256

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "phMonitor" and InitiatingProcessPort == 7900
| where FileName in ("sh", "bash", "powershell", "cmd") or ProcessCommandLine contains "whoami" or ProcessCommandLine contains "net user" or ProcessCommandLine contains "curl" or ProcessCommandLine contains "wget"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=* sourcetype=fortisiem_logs (source_process="phMonitor" OR dest_port=7900) (process_name="sh" OR process_name="bash" OR process_name="powershell" OR process_name="cmd" OR command_line="*whoami*" OR command_line="*net user*" OR command_line="*curl*" OR command_line="*wget*")

Sigma

title: FortiSIEM CVE-2025-25256 OS Command Injection
status: experimental
description: Detects potential OS command injection attempts via FortiSIEM's phMonitor service (CVE-2025-25256).
references:
    - https://fortiguard.fortinet.com/psirt/FG-IR-25-152
    - https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/
    - https://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '\phMonitor'
        ParentPort: 7900
        Image|endswith:
            - '\sh'
            - '\bash'
            - '\powershell'
            - '\cmd.exe'
        CommandLine|contains:
            - 'whoami'
            - 'net user'
            - 'curl'
            - 'wget'
    condition: selection
fields:
    - CommandLine
    - ParentImage
    - Image
    - ParentPort
tags:
    - attack.execution
    - cve.2025.25256
    - fortinet
    - fortisiem

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and process.parent.executable == "phMonitor" and process.parent.port == 7900 and (process.executable in ("sh", "bash", "powershell", "cmd") or process.command_line : ("*whoami*", "*net user*", "*curl*", "*wget*"))