Detection rules › Sigma
FortiGate - New Administrator Account Created
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Known false positives
- An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Rule body
title: FortiGate - New Administrator Account Created
id: cd0a4943-0edd-42cf-b50c-06f77a10d4c1
status: experimental
description: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2025-11-01
tags:
- attack.persistence
- attack.t1136.001
logsource:
product: fortigate
service: event
detection:
selection:
action: 'Add'
cfgpath: 'system.admin'
condition: selection
falsepositives:
- An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
action: 'Add'
cfgpath: 'system.admin'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
action | eq |
| field:"action" kind:eq value:"Add" |
cfgpath | eq |
| field:"cfgpath" kind:eq value:"system.admin" |