detection.wiki

Fortinet

Search Fortinet rules.

Telemetry Evidence

These values show how indexed rules identify Fortinet telemetry.

Elastic

  • Index logs-fortinet_fortigate.* (1 rule)
  • Index logs-fortinet_fortigate.log-* (11 rules)
  • Integration fortinet_fortigate (19 rules)

Kusto

  • Queried source table Fortiweb (1 rule)

Sigma

  • Log-source product fortigate (7 rules)
  • Log-source product fortios (1 rule)

Detection Rules

Elastic #

  • Accepted Default Telnet Port Connection source medium: This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.T1021, T1071, T1133, T1190
  • Cobalt Strike Command and Control Beacon source high: Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control.T1071, T1071.001, T1568, T1568.002
  • Elastic Defend and Network Security Alerts Correlation source high: This rule correlate any Elastic Defend alert with a set of suspicious events from Network security devices like Palo Alto Networks (PANW) and Fortinet Fortigate by host.ip and source.ip. This may indicate that this host is compromised and triggering multi-datasource alerts.
  • First-Time FortiGate Administrator Login source high: This rule detects the first observed successful login of a user with the Administrator role to the FortiGate management interface within the last 5 days. First-time administrator logins can indicate newly provisioned accounts, misconfigurations, or unauthorized access using valid credentials and should be reviewed promptly.T1078
  • FortiGate Administrator Login from Multiple IP Addresses source high: This rule detects successful logins to the FortiGate management interface using the same Administrator account from multiple distinct source IP addresses within an 24-hour period. Administrator logins from multiple locations in a short time window may indicate credential sharing, compromised credentials, or unauthorized access and should be investigated.T1078
  • FortiGate FortiCloud SSO Login from Unusual Source source medium: This rule detects the first successful FortiCloud SSO login from a previously unseen source IP address to a FortiGate device within the last 5 days. FortiCloud SSO logins from new source IPs may indicate exploitation of SAML-based authentication bypass vulnerabilities such as CVE-2026-24858, where crafted SAML assertions allow unauthorized access to FortiGate devices registered to other accounts. Environments that regularly use FortiCloud SSO will only alert on new source IPs not seen in the lookback window.T1078, T1078.004, T1190, T1606, T1606.002
  • FortiGate SOCKS Traffic from an Unusual Process source medium: This detection correlates FortiGate's application control SOCKS events with Elastic Defend network event to identify the source process performing SOCKS traffic. Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.T1090
  • FortiGate SSL VPN Login Followed by SIEM Alert by User source medium: Detects when a FortiGate SSL VPN login event is followed by any SIEM detection alert for the same user name within a short time window. This correlation can indicate abuse of VPN access for malicious activity, credential compromise used from a VPN session, or initial access via VPN followed by post-compromise behavior.T1078
  • Newly Observed FortiGate Alert source critical: This rule detects FortiGate alerts that are observed for the first time in the previous 5 days of alert history. Analysts can use this to prioritize triage and response.
  • Potential DNS Tunneling via Long and Unique Subdomains source medium: Identifies a client generating many unique, unusually long DNS query names to the same registered domain within a five-minute window. Malware DNS tunnels and DNS command-and-control commonly encode data in lengthy subdomain portions under one apex domain.T1048, T1048.003, T1071, T1071.004, T1572
Show 9 more
  • React2Shell Network Security Alert source high: This rule identifies network security alerts related to CVE-2025-55182 exploitation attempts from different network security integrations. CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor.T1059, T1059.007, T1190
  • Roshal Archive (RAR) or PowerShell File Downloaded from the Internet source medium: Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control.T1105
  • RPC (Remote Procedure Call) from the Internet source high: This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1133, T1190
  • RPC (Remote Procedure Call) to the Internet source high: This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1021, T1021.003, T1190
  • SMB (Windows File Sharing) Activity from the Internet source high: This rule detects network events that may indicate inbound Windows file sharing (SMB or CIFS) traffic originating from the Internet. SMB should never be directly reachable from the Internet, as it is a primary target for exploitation by threat actors seeking initial access. Inbound SMB from a public IP is a direct precondition for attacks such as EternalBlue (MS17-010) and related SMB remote code execution vulnerabilities.T1133, T1190
  • SMB (Windows File Sharing) Activity to the Internet source medium: This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.T1048, T1190
  • SMTP to the Internet on Port 26/TCP source low: This rule detects events that may indicate use of SMTP on TCP port 26 from an internal host to an external destination. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. The rule is scoped to outbound traffic (internal source to external destination) to focus on the command and control and exfiltration use cases, rather than benign internal mail relays or unrelated transit traffic observed by the sensor.T1048, T1071, T1071.003, T1571
  • VNC (Virtual Network Computing) from the Internet source high: This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1133, T1190, T1219
  • VNC (Virtual Network Computing) to the Internet source medium: This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1021, T1021.005, T1219

Kusto #

Sigma #

Compatible Rules

These rules declare Fortinet connector or schema compatibility without a product-specific query filter.

Kusto #