FortiOS Diagnostic Sniffer Packet Command Execution
Detects the execution of the 'diagnose sniffer packet' command on FortiOS devices. This command can be abused by malware, such as FortigateSniffer, to intercept authentication traffic, as observed in campaigns like FortiBleed.
Microsoft Sentinel (KQL)
