FortiGate: Addition of VPN SSL Web Portal via Event Logs
Detects FortiGate configuration events where a VPN SSL web portal is added.
FreeReviewedSigma · Medium · v2
- Product
- fortigate
- Service
- event
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2025-11-01
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags FortiGate events where a VPN SSL Web Portal configuration is added. Adding a web portal can establish or extend VPN access paths and may support persistence or initial access if performed by an unauthorized actor. It relies on FortiGate event telemetry indicating an 'Add' action for the vpn.ssl.web.portal configuration path.
Reporting behind it
- fortiguard.comhttps://www.fortiguard.com/psirt/FG-IR-24-535
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
fortigate-event-addition-of-vpn-ssl-web-portal-2bfb6216
title: "FortiGate: Addition of VPN SSL Web Portal via Event Logs"
id: 2cda79fa-b404-403f-acff-db1464a1165d
status: experimental
description: This rule flags FortiGate events where a VPN SSL Web Portal configuration is added. Adding a web portal can establish or extend VPN access paths and may support persistence or initial access if performed by an unauthorized actor. It relies on FortiGate event telemetry indicating an 'Add' action for the vpn.ssl.web.portal configuration path.
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
tags:
- attack.persistence
- attack.initial-access
- attack.t1133
logsource:
product: fortigate
service: event
detection:
selection:
action: Add
cfgpath: vpn.ssl.web.portal
condition: selection
falsepositives:
- A VPN SSL Web Portal can be added for legitimate purposes.
level: medium
license: DRL-1.1
related:
- id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2
type: derived