Rule Info
Name
FortiGate - New Local User Created
Author
Marco Pedrinazzi @pedrinazziM (InTheCyber)
Description
Detects the creation of a new local user on a Fortinet FortiGate Firewall.
The new local user could be used for VPN connections.
Date
2025-11-01 00:00:00
Modified
None
Id
ddbbe845-1d74-43a8-8231-2156d180234d
Tags
attack.persistence attack.t1136.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR