synoti logosynoti logo
Fortinet FortiGate

Detection rules for FortiGate Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 7 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Admin Account Compromise IndicatorsDefense Evasion, Persistence, Privilege Escalation, Initial AccessT1078 - Valid AccountsC:3 / I:3 / A:2
Data Loss Prevention TriggerExfiltrationT1048 - Exfiltration Over Alternative ProtocolC:3 / I:2 / A:1
FortiGate Admin Login from Unusual SourceInitial AccessT1078 - Valid AccountsC:3 / I:2 / A:1
FortiGate VPN Authentication Brute ForceCredential AccessT1133 - External Remote ServicesC:3 / I:2 / A:1
FortiSandbox Malicious File DetectionExecutionT1204 - User ExecutionC:3 / I:3 / A:2
Fortinet Antivirus Malware Outbreak DetectionInitial AccessT1566 - PhishingC:3 / I:3 / A:2
Fortinet IPS Critical Severity DetectionExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Admin Account Compromise Indicators (view in repository):

# Rule version v1.0.0

dataTypes:
  - firewall-fortigate-traffic
name: Admin Account Compromise Indicators
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Defense Evasion, Persistence, Privilege Escalation, Initial Access
technique: "T1078 - Valid Accounts"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://docs.fortinet.com/document/fortigate/7.4.1/fortios-log-message-reference/160372/list-of-log-types-and-subtypes
description: |
  Detects multiple failed admin login attempts followed by a successful login from the same IP address, indicating potential account compromise through credential stuffing or brute force attacks.

  Next Steps:
  1. Review the source IP address and check if it's from an expected location
  2. Contact the admin user to verify if the login was legitimate
  3. Check for any suspicious activities performed after the successful login
  4. Review other authentication logs from the same IP address
  5. Consider implementing IP-based access controls for admin accounts
  6. Enable multi-factor authentication if not already configured
  7. Reset the compromised admin account password if unauthorized access is confirmed
where: |
  equals("log.logid", "0100032001") && 
  equals("log.type", "event") && 
  equals("log.subtype", "system") && 
  equals("log.logdesc", "Admin login successful") && 
  exists("origin.ip") &&
  exists("log.user")
afterEvents:
  - indexPattern: v1-7-22-log-firewall-fortigate-traffic-*
    with:
      - field: origin.ip
        operator: filter_term
        value: '{{.origin.ip}}'
      - field: log.logdesc
        operator: filter_term
        value: 'Admin login failed'
      - field: log.user
        operator: filter_term
        value: '{{.log.user}}'
    within: now-15m
    count: 5
groupBy:
  - adversary.ip
  - target.user

Rule Details

Admin Account Compromise Indicators

Identifies several unsuccessful administrator sign-in attempts, followed by a successful sign-in from the same IP address, suggesting possible account takeover via credential stuffing or brute force.

Data Loss Prevention Trigger

Identifies attempts to remove sensitive data in violation of DLP policies. This covers credit card numbers, social security numbers, PII, financial records, and other regulated data being sent outside the network.

FortiGate Admin Login from Unusual Source

Identifies FortiGate administrator logins originating from uncommon or external IP addresses. Successful admin access from networks not used for management can point to compromised credentials.

FortiGate VPN Authentication Brute Force

Identifies repeated SSL-VPN or IPsec VPN authentication failures originating from one source IP on FortiGate, suggesting brute force or credential stuffing attempts against remote access services.

FortiSandbox Malicious File Detection

Identifies when FortiSandbox classifies a file as malicious through static scanning and behavioral analysis. This points to active malware trying to enter the network via file transfers or downloads.

Fortinet Antivirus Malware Outbreak Detection

Identifies a possible malware outbreak when multiple antivirus alerts originate from one source or target several destinations within a brief period. This may signal a broad infection attempt or a compromised system trying to propagate malware.

Fortinet IPS Critical Severity Detection

Identifies critical severity IPS events that point to active exploitation attempts or serious security threats against the network.