Detectionmediumexperimental
FortiGate - VPN SSL Settings Modified
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
fortigateevent
Productfortigate← raw: fortigate
Serviceevent← raw: event
Detection Logic
Detection Logic1 selector
detection:
selection:
action: 'Edit'
cfgpath: 'vpn.ssl.settings'
condition: selectionFalse Positives
VPN SSL settings can be changed for legitimate purposes.
MITRE ATT&CK
Rule Metadata
Rule ID
8b5dacf2-aeb7-459d-b133-678eb696d410
Status
experimental
Level
medium
Type
Detection
Created
Sat Nov 01
Path
rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml
Raw Tags
attack.persistenceattack.initial-accessattack.t1133