FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
Article Id 213558


This article describes how to use a custom event handler in FortiAnalyzer to raise alerts for incident response related to attacks that attempt to leverage the Follina Microsoft Office remote code execution vulnerability.


The event handler and report help to detect attempts to execute remote code using an exploit MSDT (Microsoft Support Diagnostics Tool) based on logs from FortiGates.


The exploit leverages Word's remote template feature to fetch an HTML file from a server, which then makes use of the 'ms-msdt://' URI scheme to run the malicious payload.


For more information, check the FortiGuard outbreak alert.


What is included in


1)  MSDT Follina_event-handler.json

This event handler helps identify MSDT Follina attacks detected by FortiGates, FortiADC, FortiClient, and FortiProxy logs.


2)  MSDT_Follina_report.dat

This report displays the findings on MSDT Follina attacks from FortiGates, FortiADC, FortiClient, and FortiProxy logs.


3)  fgt_MSDT Follina_event-handler.json

The event handler for FortiGate ADOMs is configured for FortiGate logs only.


4)  fgt_MSDT Follina_report.dat

The report for FortiGate ADOMs includes FortiGate charts only.




1)  Download the file (contains 4 files).


2)  Unzip


3)  Import MSDT Follina_event-handler.json or fgt_MSDT Follina_event-handler.json event handler:

- Choose an ADOM (if ADOMs are enabled). The ADOM may be of type Fabric or FortiGate:


- Choose the FortiSOC module. 

- Select Event Handler List.

- Select the Import option under More.

- Select the appropriate event handler depending on the

ADOM type.





The event handler is enabled and will be triggered if the appropriate logs are received following the import of the event handler. 

Edit the event handler to customize the notification section.


4)  Import MSDT_Follina_report.dat or fgt_MSDT_Follina_report.dat to Reports:


- Choose an ADOM (if ADOMs are enabled). ADOM may be of type Fabric or FortiGate.
- Choose the Report module.
- Select the Import option under 'More'.





The MSDT_Follina_report can be run anytime as determined by an admin user.