Automated FortiGate Config Exfiltration

Mehulkumar Savajani@Msavajani

•updated Jan 23, 2026•13•1•213

This rule detects when a system configuration file is downloaded from a FortiGate device within 60 seconds of a successful SSO login from the same user and source IP. This rapid sequence of events is indicative of automated scripts used by attackers to exfiltrate device configurations immediately after gaining initial access.