FortiGate - Firewall Address Object Added

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2025•1•0•68

Detects the addition of firewall address objects on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to modify network access controls to facilitate command and control, data exfiltration, or to bypass existing security policies.