Fortinet Appliance Auth bypass
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Potential Fortinet authentication bypass where multiple failed login attempts were followed by a successful login from the same source IP, device, and user
Severity
Critical
Rule Requirement
Criteria
fortinet_appliance_auth_bypass_e1: logtype = "Fortinet Device" and ACTION = "login" and STATUS contains "failed" | groupby HOSTNAME | groupby SOURCE_IP | groupby USERNAME having count >= 3 fortinet_appliance_auth_bypass_e2: logtype = "Fortinet Device" and ACTION = "login" and STATUS contains "success" and SOURCE_IP = fortinet_appliance_auth_bypass_e1.SOURCE_IP and HOSTNAME = fortinet_appliance_auth_bypass_e1.HOSTNAME and USERNAME = fortinet_appliance_auth_bypass_e1.USERNAME | groupby SOURCE_IP having count >= 1 select fortinet_appliance_auth_bypass_e1.SOURCE_IP as Client_IP, count(fortinet_appliance_auth_bypass_e1.SOURCE_IP) as Total_Matched_Count
Detection
Execution Mode
scheduled
Log Sources
Fortinet
