FortiBleed Credential Abuse Hunt
Threat hunting query designed to identify suspicious FortiGate SSL-VPN and administrative authentication activity that may indicate credential abuse following the FortiBleed 2026 credential exposure campaign. This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including: - Previously unseen user/IP combinations - Multiple users authenticating from the same source IP - Single users authenticating from multiple source IPs - Rapid country changes resembling impossible-travel scenarios - Administrative account creation or modification - Firewall and VPN configuration changes - Potential tunneling or proxy activity associated with post-compromise operations The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials. This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
Microsoft Sentinel (KQL)
