Synacktiv informational experimental sigma

FortiManager Low-privilege User Login Success

Successful login from a low-privilege user to FortiManager

View Source

Detection Logic

{
  "selection": {
    "desc": "User login/logout successful",
    "operation": "login"
  },
  "filter_user": {
    "user": [
      "admin"
    ]
  },
  "filter_profile": {
    "adminprof": [
      "Super_User"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

False Positives

  • ⚠ High-privilege accounts and/or profiles not in filter

Field Validations

Loading…

Comments (0)

Loading comments...