Potential AD Compromise Following FortiGate Configuration Export

Bryant Smith@flowstate

•updated Mar 11, 2026•1•0•88

Detects a FortiGate configuration file download followed by the creation of a new computer account in Active Directory by the 'fortidcagent' service account within a short time window. This pattern may indicate an attacker has compromised a FortiGate appliance, extracted credentials from the configuration, and is now using them to join a rogue device to the domain for lateral movement.