fortigate | Detection.FYI

FortiGate - Firewall Address Object Added

Nov 1, 2025 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

Read More
FortiGate - New Administrator Account Created

Nov 1, 2025 · attack.persistence attack.t1136.001 ·
Share on:

Detects the creation of an administrator account on a Fortinet FortiGate Firewall.

Read More
FortiGate - New Firewall Policy Added

Nov 1, 2025 · attack.defense-evasion attack.t1562 ·
Share on:

Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

Read More
FortiGate - New Local User Created

Nov 1, 2025 · attack.persistence attack.t1136.001 ·
Share on:

Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.

Read More
FortiGate - New VPN SSL Web Portal Added

Nov 1, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

Read More
FortiGate - User Group Modified

Nov 1, 2025 · attack.persistence attack.privilege-escalation ·
Share on:

Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network.

Read More
FortiGate - VPN SSL Settings Modified

Nov 1, 2025 · attack.persistence attack.initial-access attack.t1133 ·
Share on:

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

Read More