FortiGate Administrator Account Creation from Unusual Source

Last updated 6 days ago on 2026-01-28

Created 6 days ago on 2026-01-28

About

This rule detects FortiGate administrator account creation from a source IP address not previously seen performing admin operations on the device. Threat actors exploiting CVE-2026-24858 (FG-IR-26-060) authenticate via FortiCloud SSO bypass and immediately create local administrator accounts for persistence, typically from infrastructure not associated with normal administrative activity.

Tags

Use Case: Threat DetectionTactic: PersistenceDomain: NetworkDomain: IdentityData Source: FortinetData Source: Fortinet FortiGateLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Create Account (T1136)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-fortinet_fortigate.*
Related Integrations: fortinet_fortigate(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.dataset: "fortinet_fortigate.log" and
    event.code: "0100044547" and
    fortinet.firewall.cfgpath: "system.admin" and
    fortinet.firewall.action: "Add" and
    fortinet.firewall.ui: (* and not "")

Install detection rules in Elastic Security

Detect FortiGate Administrator Account Creation from Unusual Source in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).