« FirstTime Seen Account Performing DCSync FortiGate Administrator Login from Multiple IP Addresses »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

FortiGate Administrator Account Creation from Unusual Source

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

FortiGate Administrator Account Creation from Unusual Source

edit

This rule detects FortiGate administrator account creation from a source IP address not previously seen performing admin operations on the device. Threat actors exploiting CVE-2026-24858 (FG-IR-26-060) authenticate via FortiCloud SSO bypass and immediately create local administrator accounts for persistence, typically from infrastructure not associated with normal administrative activity.

Rule type: new_terms

Rule indices:

  • logs-fortinet_fortigate.*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Use Case: Threat Detection
  • Tactic: Persistence
  • Resources: Investigation Guide
  • Domain: Network
  • Domain: Identity
  • Data Source: Fortinet
  • Data Source: Fortinet FortiGate

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating FortiGate Administrator Account Creation from Unusual Source

This alert indicates that an administrator account was created on a FortiGate device from a source IP address that has not been observed performing configuration changes in the recent history window. This is a behavioral indicator of compromise, as threat actors exploiting SSO bypass vulnerabilities typically operate from infrastructure not previously associated with the device.

Possible investigation steps

  • Review source.ip to determine whether the IP address belongs to a known management network or authorized administrator location. Check against known threat infrastructure from The Constant Company LLC, BL Networks, and Kaopu Cloud HK Limited.
  • Examine fortinet.firewall.cfgobj for the name of the newly created account and fortinet.firewall.cfgattr for the access profile assigned (especially super_admin).
  • Check source.user.name to identify the account that performed the creation and verify whether it was recently created itself or accessed via SSO.
  • Look for other configuration changes from the same source IP, including firewall policy modifications, configuration exports, or VPN user creation.
  • Run get system admin on the affected FortiGate to list all current administrator accounts and compare against the authorized list.

False positive analysis

  • Authorized administrators connecting from a new location (VPN, travel, new office).
  • Initial device setup or migration where configuration changes come from temporary infrastructure.
  • Managed service providers performing authorized administration from rotating IP addresses.

Response and remediation

  • If unauthorized, immediately delete the newly created administrator account and audit the source account for compromise.
  • Block the source IP at the perimeter and check other FortiGate devices for activity from the same IP.
  • Restore configuration from a known-clean backup and rotate all credentials including LDAP/AD accounts connected to the device.
  • Upgrade FortiOS to a patched version and disable FortiCloud SSO if not required.

Rule query

edit
event.dataset: "fortinet_fortigate.log" and
    event.code: "0100044547" and
    fortinet.firewall.cfgpath: "system.admin" and
    fortinet.firewall.action: "Add" and
    fortinet.firewall.ui: (* and not "")

Framework: MITRE ATT&CKTM

« FirstTime Seen Account Performing DCSync FortiGate Administrator Login from Multiple IP Addresses »