FortiBleed Credential Stuffing Against FortiGate SSL VPN (T1110.004)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•4

This rule detects potential credential stuffing attempts against a Fortinet FortiGate SSL VPN portal. It triggers when an external source performs multiple HTTP POST requests to the /remote/login endpoint within a short period, accompanied by the FortiGate-specific header, which is indicative of automated brute-force or credential stuffing activity associated with the 'FortiBleed' campaign pattern.