FortiGate Malicious SSO Login Activity

Mehulkumar Savajani@Msavajani

•updated Jan 23, 2026•22•2•318

This rule detects successful SSO logins on FortiGate devices using usernames and source IP addresses associated with a known malicious campaign exploiting a SAML SSO bypass. The rule specifically looks for successful SSO logins (logid == "0100032001", method == "sso", status == "success") from a predefined list of malicious usernames or source IP addresses.