Detectionmediumexperimental

FortiGate - New Firewall Policy Added

Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Marco Pedrinazzi (InTheCyber)Created Sat Nov 01f24ab7a8-f09a-4319-82c1-915586aa642bnetwork

Log Source

fortigateevent

Productfortigate← raw: fortigate

Serviceevent← raw: event

Detection Logic

detection:
    selection:
        action: 'Add'
        cfgpath: 'firewall.policy'
    condition: selection

False Positives

A firewall policy can be added for legitimate purposes.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

f24ab7a8-f09a-4319-82c1-915586aa642b

Status

experimental

Level

medium

Type

Detection

Created

Sat Nov 01

Author

Path

rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml

Raw Tags

attack.defense-evasionattack.t1562