FortiCloud SSO Login Followed by Local Admin Creation - CVE-2026-24858
Detects a successful FortiCloud SSO administrative login to a Fortinet appliance followed by the creation of a local administrator account from the same source IP and user within 15 minutes. The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858. Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki "CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan esinlenilerek hazırlanmıştır.
Microsoft Sentinel (KQL)
