Neharika Razdan
@UrzuLaxjoo0 followers11 downloads5 copies0 likes57 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
1
1
1
Detects Active Directory logons (Event IDs 4624, 4768, 4769) originating from the Fortinet SSL VPN IP pool. In the context of the FortiBleed credential-harvesting campaign, attackers utilize compromised Fortinet VPN credentials to immediately pivot into internal Active Directory environments. Because pure Sigma rules evaluate a single log source, this rule targets the Windows AD telemetry. To achieve the highest fidelity, this rule should be correlated in your SIEM with FortiGate SSL VPN tunnel-up events (e.g., Event Code 32130, 39424) originating from anomalous external IPs for the same principal within a short time window.
