From Unit 42's table: 1) On ARM64 FortiGates, inspect /proc/<pid>/maps for miglogd/iked for anonymous 16384-byte rwxp regions. 2) Check text integrity at base+0x106F7B8 / 0x1072E20 / 0x109A570 for NOP-like 0xAA0003E0 (MOV X0,X0). 3) Audit syscall telemetry for open/write to /proc/*/mem between those daemons. 4) diagnose debug crashlog read for Signal 11 involving miglogd/iked/syslogd. 5) Config revisions for system.auto-script names containing ../ (esp. ../../../../setup) and ../../tmp/apache2/conf/md-acme.conf. Filenames: lldprx, pM.js, index.js/index.wasm, ipssem.js. Sample SHA-256 core injector: b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70. Staging IPs historically include 23.240.77[.]233 and 47.18.167[.]159. After any FortiManager compromise, rotate FGFM trust material and treat stolen configs as credential dumps.