FortiGate Service Account Rogue Domain Join

Ethan Andrews@eandrews

•updated Mar 16, 2026•37•0•223

Detects the creation of a new computer account (Event ID 4741) where the creating user is a known service account used by FortiGate appliances. Attackers who compromise FortiGate devices can steal embedded LDAP credentials and use them to join rogue workstations to the domain, leveraging the `mS-DS-MachineAccountQuota` attribute.