« FortiGate SSO Login Followed by Administrator Account Creation Forwarded Google Workspace Security Alert »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

FortiGate Super Admin Account Creation

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

FortiGate Super Admin Account Creation

edit

This rule detects the creation of an administrator account on a FortiGate device. Administrator account creation on these devices should be infrequent and tightly controlled. In the FG-IR-26-060 campaign, threat actors created super_admin accounts immediately after gaining initial access via FortiCloud SSO bypass to establish persistence.

Rule type: eql

Rule indices:

  • logs-fortinet_fortigate.*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Use Case: Threat Detection
  • Tactic: Persistence
  • Resources: Investigation Guide
  • Domain: Network
  • Domain: Identity
  • Data Source: Fortinet
  • Data Source: Fortinet FortiGate

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating FortiGate Super Admin Account Creation

This alert indicates that an administrator account was created on a FortiGate device. Administrator creation events on these devices are generally rare and should be closely scrutinized, as they are a key persistence mechanism used in the FG-IR-26-060 campaign.

In the observed campaign, threat actors created multiple super_admin accounts (audit, backup, support, itadmin, secadmin, remoteadmin) within seconds of initial access to ensure persistent control even if individual accounts are discovered and removed.

Possible investigation steps

  • Review fortinet.firewall.cfgobj for the name of the newly created account and examine fortinet.firewall.cfgattr to determine the access profile assigned to the account (especially super_admin).
  • Review source.user.name to determine which account performed the creation and fortinet.firewall.ui for the source interface and IP address. Verify whether this administrator is authorized to provision accounts.
  • Check whether a login event (especially via SSO) occurred shortly before the account creation. Analyze the timing between events.
  • Check observer.name to identify the FortiGate device and run get system admin to get the current administrator list. Check other FortiGate devices in the fleet for the same account name.

False positive analysis

  • Authorized provisioning of a new administrator account through an approved change management process.
  • Initial device setup where administrator accounts are created as part of deployment.
  • Migration or device replacement scenarios where accounts are replicated from another device.

Response and remediation

  • If unauthorized, delete the administrator account immediately and audit the creating account for compromise.
  • Treat the device configuration as compromised and restore from a known-clean backup.
  • Check all FortiGate devices for similar account creation and upgrade FortiOS to a patched version.
  • If the activity is expected, document the provisioning activity and the business justification.

Rule query

edit
any where event.dataset == "fortinet_fortigate.log" and
    event.code == "0100044547" and
    fortinet.firewall.cfgpath == "system.admin" and
    fortinet.firewall.action == "Add" and
    fortinet.firewall.cfgattr like~ "*accprofile[super_admin]*"

Framework: MITRE ATT&CKTM

« FortiGate SSO Login Followed by Administrator Account Creation Forwarded Google Workspace Security Alert »