Fortinet Appliance Auth bypass
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Potential Fortinet authentication bypass where multiple failed login attempts were followed by a successful login from the same source IP, device, and user
Severity
Critical
Rule Requirement
Criteria
fortinet_appliance_auth_bypass_e1:
logtype = "Fortinet Device" and ACTION = "login" and STATUS contains "failed"
| groupby HOSTNAME
| groupby SOURCE_IP
| groupby USERNAME having count >= 3
fortinet_appliance_auth_bypass_e2:
logtype = "Fortinet Device" and ACTION = "login" and STATUS contains "success" and SOURCE_IP = fortinet_appliance_auth_bypass_e1.SOURCE_IP and HOSTNAME = fortinet_appliance_auth_bypass_e1.HOSTNAME and USERNAME = fortinet_appliance_auth_bypass_e1.USERNAME
| groupby SOURCE_IP having count >= 1
sequence:fortinet_appliance_auth_bypass_e1 followedby fortinet_appliance_auth_bypass_e2 within 10m
select fortinet_appliance_auth_bypass_e1.SOURCE_IP as Client_IP, count(fortinet_appliance_auth_bypass_e1.SOURCE_IP) as Total_Matched_Count
Detection
Execution Mode
scheduled
Log Sources
Fortinet
