Rule Info
Name
FortiGate - User Group Modified
Author
Marco Pedrinazzi @pedrinazziM (InTheCyber)
Description
Detects the modification of a user group on a Fortinet FortiGate Firewall.
The group could be used to grant VPN access to a network.
Date
2025-11-01 00:00:00
Modified
None
Id
69ffc84e-8b1a-4024-8351-e018f66b8275
Tags
attack.persistence attack.privilege-escalation
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR