backdoor: China.Chopper.Webshell.Client.Connection (Inquiry)

[dec0der]

Hello,

Our fortinet product detected the following:   backdoor: China.Chopper.Webshell.Client.Connection

I'd like to know how fortinet interprets this alert. Does this mean Webshell traffic was/is detected and confirmed to be happening on the system, or is this just an alert that lets us know when "attempted" Webshell exploit activity is detected?

Thanks in Advance!

[localhost]

Signature default is blocking for China Chopper.

So if you didn't manually overwrite the action, it got blocked:

The action should also be visible in your IPS Log on your Fortigate. Example from FortiAnalyzer: