Detectionmediumexperimental

FortiGate - New Local User Created

Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Marco Pedrinazzi (InTheCyber)Created Sat Nov 01ddbbe845-1d74-43a8-8231-2156d180234dnetwork

Log Source

fortigateevent

Productfortigate← raw: fortigate

Serviceevent← raw: event

Detection Logic

detection:
    selection:
        action: 'Add'
        cfgpath: 'user.local'
    condition: selection

False Positives

A local user can be created for legitimate purposes. Investigate the user details to determine if it is authorized.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

ddbbe845-1d74-43a8-8231-2156d180234d

Status

experimental

Level

medium

Type

Detection

Created

Sat Nov 01

Author

Path

rules/network/fortinet/fortigate/fortinet_fortigate_new_local_user_created.yml

Raw Tags

attack.persistenceattack.t1136.001