yasemin barutcu
@yaseminNetherlandsCompletionist
0 followers0 downloads11 copies0 likes68 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Products / Services
1
MITRE Techniques
1
1
1
CVEs
1
IDS Classtypes
1
Detects a successful FortiCloud SSO administrative login to a Fortinet appliance followed by the creation of a local administrator account from the same source IP and user within 15 minutes.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
