FortiGate Firewall - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/fortigate-firewall/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 03 Jul 2026 13:55:23 +0000FortiGate - New VPN SSL Web Portal Addedhttps://feed.craftedsignal.io/briefs/2026-07-fortigate-vpn-ssl-web-portal-added/Fri, 03 Jul 2026 13:55:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-fortigate-vpn-ssl-web-portal-added/This brief details a detection for the addition of a new VPN SSL Web Portal on FortiGate Firewalls, a configuration change that could be utilized by attackers for establishing persistence or initial access to external remote services, as indicated by observed modifications of VPN SSL settings.This brief focuses on detecting the addition of a new VPN SSL Web Portal on Fortinet FortiGate Firewalls. FortiGate firewalls are critical network security appliances, and VPN SSL portals are key components for secure remote access. The addition of such a portal, especially when observed alongside other modifications to VPN SSL settings, is a suspicious administrative action. This behavior could indicate an attacker, having gained initial access to the FortiGate device, is attempting to establish a new, potentially covert, access vector for persistence or to facilitate continued initial access through external remote services. While this specific activity is a configuration change, it aligns with techniques used by adversaries to maintain unauthorized access or to simplify re-entry into a compromised network. Organizations should investigate such changes promptly to prevent further compromise.

Impact

If an attacker successfully adds a new VPN SSL Web Portal to a FortiGate Firewall, they could establish a persistent backdoor for unauthorized access into the internal network, bypassing existing security controls. This allows them to maintain a foothold even if their initial access method is remediated. Such unauthorized access can lead to further malicious activities, including data exfiltration, deployment of malware, lateral movement within the network, or disruption of critical services, potentially impacting data confidentiality, integrity, and availability for the entire organization.

Recommendation

  • Deploy the Sigma rule "FortiGate - New VPN SSL Web Portal Added" to your SIEM solution to detect suspicious configuration changes.
  • Ensure comprehensive fortigate event logs are collected and ingested from all FortiGate devices.
  • Investigate all alerts generated by this rule for action: 'Add' and cfgpath: 'vpn.ssl.web.portal', verifying the legitimacy and authorization of the change.
  • Refer to the FortiGuard PSIRT advisory FG-IR-24-535 for related security vulnerabilities and mitigation guidance concerning FortiGate VPN SSL services.
]]>mediumadvisoryfortigatevpnconfiguration-changenetwork-devicepersistenceinitial-accessFortiGate - New Administrator Account Createdhttps://feed.craftedsignal.io/briefs/2026-07-fortigate-new-admin-account/Fri, 03 Jul 2026 13:52:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-fortigate-new-admin-account/This brief describes how to detect the creation of new administrator accounts on Fortinet FortiGate firewalls, a behavior often used by attackers for persistence (ATT&CK T1136.001) or to maintain unauthorized access after initial compromise.This detection brief focuses on identifying the creation of new administrator accounts on Fortinet FortiGate firewall devices. Attackers frequently use the creation of new user accounts, particularly those with administrative privileges, as a post-exploitation technique to establish persistence and ensure continued access to compromised environments. While legitimate administrator accounts are routinely created for operational purposes, an unauthorized account creation can signify a successful breach, an insider threat, or the escalation of privileges within the network. This alert is crucial for defenders to identify suspicious activity that could lead to unauthorized configuration changes, data exfiltration, or further network compromise. The provided Sigma rule leverages FortiGate's event logs to pinpoint these critical configuration changes.

Attack Chain

[The source material for this brief focuses on a specific detection capability rather than detailing a full attack chain. Therefore, a complete attack chain cannot be constructed.]

Impact

If an unauthorized administrator account is successfully created on a FortiGate firewall, attackers gain full control over the network's security perimeter. This can lead to a wide range of devastating impacts, including the disablement of security features (e.g., VPNs, IPS, antivirus), creation of rogue network access rules, redirection of traffic, exfiltration of sensitive data, or complete disruption of network services. Such an event provides attackers with a stealthy and persistent foothold, making detection and remediation significantly more challenging and potentially leading to extensive financial and reputational damage.

Recommendation

  • Deploy the Sigma rule "FortiGate - New Administrator Account Created" to your SIEM and tune for your environment to detect unauthorized account creations.
  • Ensure FortiGate event logging is properly configured and integrated with your SIEM to capture cfgpath: 'system.admin' events.
  • Regularly review FortiGate access logs for unusual login patterns, especially from newly created accounts.
  • Implement multi-factor authentication for all administrative accounts on FortiGate devices.
]]>mediumadvisoryattack.persistenceattack.t1136.001network-devicefortinet