FortiBleed FortiGate adversary-in-the-middle listening post - internal auth traffic from firewall management IP

Kaung Khant Ko@kaungkhantko

•updated Jun 23, 2026•0•0•8

This rule detects potential adversary-in-the-middle (AiTM) activity targeting FortiGate firewalls, specifically looking for internal authentication traffic (LDAP, Kerberos, LDAPS, MS-SQL) originating from a firewall management IP. The rule triggers if there are 5 such connections within 60 seconds, indicating a possible listening post or attempt to intercept credentials.