Detectionmediumexperimental

FortiGate - User Group Modified

Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Marco Pedrinazzi (InTheCyber)Created Sat Nov 0169ffc84e-8b1a-4024-8351-e018f66b8275network

Log Source

fortigateevent

Productfortigate← raw: fortigate

Serviceevent← raw: event

Detection Logic

detection:
    selection:
        action: 'Edit'
        cfgpath: 'user.group'
    condition: selection

False Positives

A group can be modified for legitimate purposes.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

69ffc84e-8b1a-4024-8351-e018f66b8275

Status

experimental

Level

medium

Type

Detection

Created

Sat Nov 01

Author

Path

rules/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml

Raw Tags

attack.persistenceattack.privilege-escalation