CVE-2025-58034

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("sh", "bash", "cmd.exe", "powershell.exe")
| where InitiatingProcessFileName =~ "httpd" or InitiatingProcessFileName =~ "nginx" // Assuming FortiWeb uses common web server processes
| where ProcessCommandLine has_any ("curl", "wget", "nc", "python", "perl", "php", "ruby", "java", "system", "exec") // Common command injection indicators
| where ProcessCommandLine has "&" or ProcessCommandLine has "|" or ProcessCommandLine has ";" or ProcessCommandLine has "`" or ProcessCommandLine has "$" // OS command injection specific characters
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

Splunk SPL

index=your_fortiweb_logs (source="http" OR source="cli") (command="sh" OR command="bash" OR command="cmd.exe" OR command="powershell.exe") (eval(match(_raw, "&|;|`|$")) OR eval(match(_raw, "curl|wget|nc|python|perl|php|ruby|java|system|exec")))
| table _time, host, source, command, _raw

Sigma

title: FortiWeb OS Command Injection Attempt
logsource:
  category: process_creation
  product: linux # Or windows, depending on FortiWeb's underlying OS
detection:
  selection:
    ParentImage|endswith:
      - '\httpd'
      - '\nginx'
    Image|endswith:
      - '\sh'
      - '\bash'
      - '\cmd.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - '&'
      - '|'
      - ';'
      - '`'
      - '$('
      - 'curl'
      - 'wget'
      - 'nc'
      - 'python'
      - 'perl'
      - 'php'
      - 'ruby'
      - 'java'
      - 'system'
      - 'exec'
  condition: selection
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and 
  (process.parent.executable : ("httpd", "nginx") or process.parent.name : ("httpd", "nginx")) and 
  (process.executable : ("sh", "bash", "cmd.exe", "powershell.exe") or process.name : ("sh", "bash", "cmd.exe", "powershell.exe")) and 
  (process.command_line : ("&", "|", ";", "`", "$(") or process.command_line : ("curl", "wget", "nc", "python", "perl", "php", "ruby", "java", "system", "exec"))
| project @timestamp, host.name, process.parent.executable, process.executable, process.command_line