Mass Administrative Logon Surge on FortiClient EMS Servers Preceding Ransomware Handoff

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•1

This rule identifies endpoints identified as EMS or FortiClient that exhibit an unusually high number of login events (greater than 20) or a high number of unique accounts logging in (greater than 10) within a specific timeframe. This behavior may indicate unauthorized access attempts, automated password spraying, or potential lateral movement activity directed at remote access infrastructure.