FortiGate Operations by AI-Augmented Threat Actor
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
Microsoft Sentinel (KQL)
