FortiGate User Group Modified

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2025•0•76

Detects the modification of a user group on a Fortinet FortiGate Firewall. This activity could be used by an attacker to grant themselves or other malicious accounts VPN access to a network, facilitating persistence or privilege escalation.