Unauthorized FortiWeb Admin Account Creation
Detects the creation of a new administrative account with 'prof_admin' privileges on a FortiWeb device from an unknown IP address. This activity is highly suspicious if not performed by a known administrator and could indicate post-exploitation activity, potentially related to CVE-2025-64446.
Microsoft Sentinel (KQL)
