FortiGate Backdoor Admin Account 'adminin' Creation
Detects the creation of an administrative account named 'adminin' on FortiGate devices. This specific account name has been linked to the 'FortiBleed' credential theft campaign, which often serves as a precursor to ransomware deployment by threat actors like the INC Ransom group.
Sigma
