FortiGate Super Admin Account Creation

 1[metadata]
 2creation_date = "2026/01/28"
 3integration = ["fortinet_fortigate"]
 4maturity = "production"
 5updated_date = "2026/01/28"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects the creation of an administrator account on a FortiGate device. Administrator account creation on
11these devices should be infrequent and tightly controlled. In the FG-IR-26-060 campaign, threat actors created
12super_admin accounts immediately after gaining initial access via FortiCloud SSO bypass to establish persistence.
13"""
14from = "now-9m"
15interval = "5m"
16index = ["logs-fortinet_fortigate.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "FortiGate Super Admin Account Creation"
20note = """## Triage and analysis
21
22### Investigating FortiGate Super Admin Account Creation
23
24This alert indicates that an administrator account was created on a FortiGate device. Administrator creation events on these devices are generally rare and should be closely scrutinized, as they are a key persistence mechanism used in the FG-IR-26-060 campaign.
25
26In the observed campaign, threat actors created multiple super_admin accounts (audit, backup, support, itadmin, secadmin, remoteadmin) within seconds of initial access to ensure persistent control even if individual accounts are discovered and removed.
27
28### Possible investigation steps
29
30- Review `fortinet.firewall.cfgobj` for the name of the newly created account and examine `fortinet.firewall.cfgattr` to determine the access profile assigned to the account (especially super_admin).
31- Review `source.user.name` to determine which account performed the creation and `fortinet.firewall.ui` for the source interface and IP address. Verify whether this administrator is authorized to provision accounts.
32- Check whether a login event (especially via SSO) occurred shortly before the account creation. Analyze the timing between events.
33- Check `observer.name` to identify the FortiGate device and run `get system admin` to get the current administrator list. Check other FortiGate devices in the fleet for the same account name.
34
35### False positive analysis
36
37- Authorized provisioning of a new administrator account through an approved change management process.
38- Initial device setup where administrator accounts are created as part of deployment.
39- Migration or device replacement scenarios where accounts are replicated from another device.
40
41### Response and remediation
42
43- If unauthorized, delete the administrator account immediately and audit the creating account for compromise.
44- Treat the device configuration as compromised and restore from a known-clean backup.
45- Check all FortiGate devices for similar account creation and upgrade FortiOS to a patched version.
46- If the activity is expected, document the provisioning activity and the business justification."""
47references = [
48    "https://www.fortiguard.com/psirt/FG-IR-26-060",
49    "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios",
50    "https://www.elastic.co/docs/reference/integrations/fortinet_fortigate",
51    "https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026",
52]
53risk_score = 47
54rule_id = "cbbe0523-33f3-4420-b88d-5c940d9e72c1"
55severity = "medium"
56tags = [
57    "Use Case: Threat Detection",
58    "Tactic: Persistence",
59    "Resources: Investigation Guide",
60    "Domain: Network",
61    "Domain: Identity",
62    "Data Source: Fortinet",
63    "Data Source: Fortinet FortiGate",
64]
65timestamp_override = "event.ingested"
66type = "eql"
67
68query = '''
69any where event.dataset == "fortinet_fortigate.log" and
70    event.code == "0100044547" and
71    fortinet.firewall.cfgpath == "system.admin" and
72    fortinet.firewall.action == "Add" and
73    fortinet.firewall.cfgattr like~ "*accprofile[super_admin]*"
74'''
75
76
77[[rule.threat]]
78framework = "MITRE ATT&CK"
79[[rule.threat.technique]]
80id = "T1136"
81name = "Create Account"
82reference = "https://attack.mitre.org/techniques/T1136/"
83[[rule.threat.technique.subtechnique]]
84id = "T1136.001"
85name = "Local Account"
86reference = "https://attack.mitre.org/techniques/T1136/001/"
87
88
89
90[rule.threat.tactic]
91id = "TA0003"
92name = "Persistence"
93reference = "https://attack.mitre.org/tactics/TA0003/"