Tag
medium
advisory
FortiGate - New VPN SSL Web Portal Added
1 rule 2 TTPsThis brief details a detection for the addition of a new VPN SSL Web Portal on FortiGate Firewalls, a configuration change that could be utilized by attackers for establishing persistence or initial access to external remote services, as indicated by observed modifications of VPN SSL settings.
FortiGate Firewall
fortigate
vpn
configuration-change
network-device
persistence
initial-access
1r
2t
high
threat
Detection of Suspicious Cisco Configuration Changes via Archive Logging
3 rules 2 TTPs 2 CVEs 6 IOCsThis analytic detects suspicious configuration changes on Cisco devices by analyzing archive logs for activities such as backdoor account creation, SNMP community string modifications, and TFTP server configurations, potentially indicating attacker presence and lateral movement.
IOS +6
Static Tundra
cisco
network-security
configuration-change
3r
2t
2c
6i
updated
high
advisory
AWS Config Configuration Recorder Stopped
2 rules 2 TTPsDetection of AWS Config configuration recorder being stopped, potentially by an adversary to evade detection and obscure activity.
AWS Config
aws
cloudtrail
defense-evasion
configuration-change
2r
2t