Data Source: Fortinet FortiGate

First-Time FortiGate Administrator Login

Jan 30, 2026 · Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide Domain: Network Domain: Identity Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects the first observed successful login of a user with the Administrator role to the FortiGate management interface within the last 5 days. First-time administrator logins can indicate newly provisioned accounts, misconfigurations, or unauthorized access using valid credentials and should be reviewed promptly.

FortiGate Administrator Account Creation from Unusual Source

Jan 30, 2026 · Use Case: Threat Detection Tactic: Persistence Resources: Investigation Guide Domain: Network Domain: Identity Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects FortiGate administrator account creation from a source IP address not previously seen performing admin operations on the device. Threat actors exploiting CVE-2026-24858 (FG-IR-26-060) authenticate via FortiCloud SSO bypass and immediately create local administrator accounts for persistence, typically from infrastructure not associated with normal administrative activity.

FortiGate Administrator Login from Multiple IP Addresses

Jan 30, 2026 · Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide Domain: Network Domain: Identity Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects successful logins to the FortiGate management interface using the same Administrator account from multiple distinct source IP addresses within an 24-hour period. Administrator logins from multiple locations in a short time window may indicate credential sharing, compromised credentials, or unauthorized access and should be investigated.

FortiGate Configuration File Downloaded

Jan 30, 2026 · Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide Domain: Network Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects the download of a FortiGate device configuration file. Configuration exports contain sensitive data including administrator password hashes, LDAP bind credentials, VPN pre-shared keys, routing tables, and firewall policies. Threat actors exploiting CVE-2026-24858 have been observed exporting the full device configuration immediately after gaining access to harvest credentials and map the internal network.

FortiGate FortiCloud SSO Login from Unusual Source

Jan 30, 2026 · Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide Domain: Network Domain: Identity Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects the first successful FortiCloud SSO login from a previously unseen source IP address to a FortiGate device within the last 5 days. FortiCloud SSO logins from new source IPs may indicate exploitation of SAML-based authentication bypass vulnerabilities such as CVE-2026-24858, where crafted SAML assertions allow unauthorized access to FortiGate devices registered to other accounts. Environments that regularly use FortiCloud SSO will only alert on new source IPs not seen in the lookback window.

FortiGate Overly Permissive Firewall Policy Created

Jan 30, 2026 · Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Domain: Network Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects the creation or modification of a FortiGate firewall policy that permits all sources, all destinations, and all services. An overly permissive policy effectively bypasses all firewall protections. Threat actors exploiting CVE-2026-24858 have been observed creating such policies to allow unrestricted traffic flow through compromised FortiGate devices.

FortiGate SSO Login Followed by Administrator Account Creation

Jan 30, 2026 · Use Case: Threat Detection Tactic: Persistence Resources: Investigation Guide Domain: Network Domain: Identity Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects a FortiCloud SSO login followed by administrator account creation on the same FortiGate device within 15 minutes. This sequence is a high-confidence indicator of the FG-IR-26-060 attack pattern, where threat actors authenticate via SAML-based SSO bypass and immediately create local administrator accounts for persistence.

FortiGate Super Admin Account Creation

Jan 30, 2026 · Use Case: Threat Detection Tactic: Persistence Resources: Investigation Guide Domain: Network Domain: Identity Data Source: Fortinet Data Source: Fortinet FortiGate ·

Share on:

This rule detects the creation of an administrator account on a FortiGate device. Administrator account creation on these devices should be infrequent and tightly controlled. In the FG-IR-26-060 campaign, threat actors created super_admin accounts immediately after gaining initial access via FortiCloud SSO bypass to establish persistence.