Skip to content

Commit 4dfbd6b

Browse files
inthecyberfrack113Tommaso Tosinasbench
authored
Merge PR #5197 from @inthecyber - Add new Fortinet Fortigate rules
new: FortiGate - New Administrator Account Created new: FortiGate - Firewall Address Object Added new: FortiGate - New Firewall Policy Added new: FortiGate - New Local User Created new: FortiGate - New VPN SSL Web Portal Added new: FortiGate - User Group Modified new: FortiGate - VPN SSL Settings Modified --------- Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com> Co-authored-by: Tommaso Tosi <tommaso.tosi@inthecyber.com> Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
1 parent a77d3ba commit 4dfbd6b

9 files changed

+196
-0
lines changed

‎rules/network/fortinet/fortigate/fortinet_fortigate_new_admin_account_created.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
title: FortiGate - New Administrator Account Created
2+
id: cd0a4943-0edd-42cf-b50c-06f77a10d4c1
3+
status: experimental
4+
description: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
5+
references:
6+
- https://www.fortiguard.com/psirt/FG-IR-24-535
7+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
8+
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin
9+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
10+
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
11+
date: 2025-11-01
12+
tags:
13+
- attack.persistence
14+
- attack.t1136.001
15+
logsource:
16+
product: fortigate
17+
service: event
18+
detection:
19+
selection:
20+
action: 'Add'
21+
cfgpath: 'system.admin'
22+
condition: selection
23+
falsepositives:
24+
- An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized.
25+
level: medium

‎rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_address_object.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
title: FortiGate - Firewall Address Object Added
2+
id: 5c8d7b41-3812-432f-a0bb-4cfb7c31827e
3+
status: experimental
4+
description: Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
5+
references:
6+
- https://www.fortiguard.com/psirt/FG-IR-24-535
7+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
8+
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address
9+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
10+
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
11+
date: 2025-11-01
12+
tags:
13+
- attack.defense-evasion
14+
- attack.t1562
15+
logsource:
16+
product: fortigate
17+
service: event
18+
detection:
19+
selection:
20+
action: 'Add'
21+
cfgpath: 'firewall.address'
22+
condition: selection
23+
falsepositives:
24+
- An address could be added or deleted for legitimate purposes.
25+
level: medium

‎rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
title: FortiGate - New Firewall Policy Added
2+
id: f24ab7a8-f09a-4319-82c1-915586aa642b
3+
status: experimental
4+
description: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
5+
references:
6+
- https://www.fortiguard.com/psirt/FG-IR-24-535
7+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
8+
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
9+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
10+
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
11+
date: 2025-11-01
12+
tags:
13+
- attack.defense-evasion
14+
- attack.t1562
15+
logsource:
16+
product: fortigate
17+
service: event
18+
detection:
19+
selection:
20+
action: 'Add'
21+
cfgpath: 'firewall.policy'
22+
condition: selection
23+
falsepositives:
24+
- A firewall policy can be added for legitimate purposes.
25+
level: medium

‎rules/network/fortinet/fortigate/fortinet_fortigate_new_local_user_created.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
title: FortiGate - New Local User Created
2+
id: ddbbe845-1d74-43a8-8231-2156d180234d
3+
status: experimental
4+
description: |
5+
Detects the creation of a new local user on a Fortinet FortiGate Firewall.
6+
The new local user could be used for VPN connections.
7+
references:
8+
- https://www.fortiguard.com/psirt/FG-IR-24-535
9+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
10+
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local
11+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
12+
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
13+
date: 2025-11-01
14+
tags:
15+
- attack.persistence
16+
- attack.t1136.001
17+
logsource:
18+
product: fortigate
19+
service: event
20+
detection:
21+
selection:
22+
action: 'Add'
23+
cfgpath: 'user.local'
24+
condition: selection
25+
falsepositives:
26+
- A local user can be created for legitimate purposes. Investigate the user details to determine if it is authorized.
27+
level: medium

‎rules/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
title: FortiGate - New VPN SSL Web Portal Added
2+
id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2
3+
status: experimental
4+
description: |
5+
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
6+
This behavior was observed in pair with modification of VPN SSL settings.
7+
references:
8+
- https://www.fortiguard.com/psirt/FG-IR-24-535
9+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
10+
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
11+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
12+
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
13+
date: 2025-11-01
14+
tags:
15+
- attack.persistence
16+
- attack.initial-access
17+
- attack.t1133
18+
logsource:
19+
product: fortigate
20+
service: event
21+
detection:
22+
selection:
23+
action: 'Add'
24+
cfgpath: 'vpn.ssl.web.portal'
25+
condition: selection
26+
falsepositives:
27+
- A VPN SSL Web Portal can be added for legitimate purposes.
28+
level: medium

‎rules/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
title: FortiGate - User Group Modified
2+
id: 69ffc84e-8b1a-4024-8351-e018f66b8275
3+
status: experimental
4+
description: |
5+
Detects the modification of a user group on a Fortinet FortiGate Firewall.
6+
The group could be used to grant VPN access to a network.
7+
references:
8+
- https://www.fortiguard.com/psirt/FG-IR-24-535
9+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
10+
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
11+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
12+
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
13+
date: 2025-11-01
14+
tags:
15+
- attack.persistence
16+
- attack.privilege-escalation
17+
# - attack.t1098.007
18+
logsource:
19+
product: fortigate
20+
service: event
21+
detection:
22+
selection:
23+
action: 'Edit'
24+
cfgpath: 'user.group'
25+
condition: selection
26+
falsepositives:
27+
- A group can be modified for legitimate purposes.
28+
level: medium

‎rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
title: FortiGate - VPN SSL Settings Modified
2+
id: 8b5dacf2-aeb7-459d-b133-678eb696d410
3+
status: experimental
4+
description: |
5+
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
6+
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
7+
references:
8+
- https://www.fortiguard.com/psirt/FG-IR-24-535
9+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
10+
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings
11+
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr
12+
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
13+
date: 2025-11-01
14+
tags:
15+
- attack.persistence
16+
- attack.initial-access
17+
- attack.t1133
18+
logsource:
19+
product: fortigate
20+
service: event
21+
detection:
22+
selection:
23+
action: 'Edit'
24+
cfgpath: 'vpn.ssl.settings'
25+
condition: selection
26+
falsepositives:
27+
- VPN SSL settings can be changed for legitimate purposes.
28+
level: medium

‎tests/logsource.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,14 @@
181181
"syslog":[]
182182
}
183183
},
184+
"fortigate":{
185+
"common": [],
186+
"empty": [],
187+
"category":{},
188+
"service":{
189+
"event":["devname","devid","logid","type","subtype","level","vd","logdesc","user","ui","action","cfgtid","cfgpath","cfgobj","cfgattr","msg"]
190+
}
191+
},
184192
"fortios":{
185193
"common": [],
186194
"empty": [],

‎tests/test_rules.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -611,6 +611,8 @@ def test_file_names(self):
611611
pattern_prefix = "onelogin_"
612612
elif value == "github":
613613
pattern_prefix = "github_"
614+
elif value == "fortinet":
615+
pattern_prefix = "fortinet_"
614616
elif key == "category":
615617
if value == "process_creation":
616618
pattern_prefix = "proc_creation_"

0 commit comments

Comments
 (0)