CVE-2025-61624

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "auto-script" and InitiatingProcessCommandLine contains "path traversal"
| where FileName in ("lldprx", "ipssem.js", "index.js", "index.wasm", "pM.js") or ProcessCommandLine contains "23.240.77.233:8085"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

(sourcetype=fortios OR sourcetype=linux_audit) (command_line="*auto-script*path traversal*" OR process_name IN ("lldprx", "ipssem.js", "index.js", "index.wasm", "pM.js") OR command_line="*23.240.77.233:8085*")
| table _time, host, command_line, process_name, parent_process_name, dest, sha256

Sigma

title: FortiOS PEERSTITCH Path Traversal Exploitation
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects exploitation of FortiOS path traversal vulnerability (CVE-2025-61624) to deploy PEERSTITCH malware.
author: SecBoard
date: 2026/10/16
logsource:
  product: fortios
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - 'auto-script'
      - 'path traversal'
    Image|endswith:
      - 'lldprx'
      - 'ipssem.js'
      - 'index.js'
      - 'index.wasm'
      - 'pM.js'
    CommandLine|contains:
      - '23.240.77.233:8085'
  condition: selection
falsepositives:
  - Legitimate auto-scripts (requires tuning)
level: high

Elastic ES|QL

from process where process.command_line : "*auto-script*path traversal*" or process.executable.name in ("lldprx", "ipssem.js", "index.js", "index.wasm", "pM.js") or process.command_line : "*23.240.77.233:8085*"