Skip to content
Threat Feed
Subscribe

Product

FortiGate Firewall

2 briefs RSS
medium advisory

FortiGate - New VPN SSL Web Portal Added

This brief details a detection for the addition of a new VPN SSL Web Portal on FortiGate Firewalls, a configuration change that could be utilized by attackers for establishing persistence or initial access to external remote services, as indicated by observed modifications of VPN SSL settings.

FortiGate Firewall fortigate vpn configuration-change network-device persistence initial-access
1r 2t
medium advisory

FortiGate - New Administrator Account Created

This brief describes how to detect the creation of new administrator accounts on Fortinet FortiGate firewalls, a behavior often used by attackers for persistence (ATT&CK T1136.001) or to maintain unauthorized access after initial compromise.

FortiGate Firewall attack.persistence attack.t1136.001 network-device fortinet
1r 1t