FortiGate Firewall Address Object Added

Alerts when a FortiGate firewall address object is added via configuration change events.

FreeUnreviewedSigmamediumv1

fortigate-firewall-address-object-added-5c8d7b41

title: FortiGate Firewall Address Object Added
id: a6ae3b49-54ff-4a3d-be7e-d83243df20b0
status: experimental
description: "This rule flags events where a Fortinet FortiGate configuration update adds a firewall address object (cfgpath: firewall.address, action: Add). Attackers and administrators may use address objects to stage access changes or prepare subsequent firewall policy modifications. It relies on FortiGate event telemetry that records configuration object attribute changes, including the action and configuration path."
references:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_address_object.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
modified: 2026-05-04
tags:
  - attack.defense-impairment
  - attack.t1686.002
logsource:
  product: fortigate
  service: event
detection:
  selection:
    action: Add
    cfgpath: firewall.address
  condition: selection
falsepositives:
  - An address could be added or deleted for legitimate purposes.
level: medium
license: DRL-1.1
related:
  - id: 5c8d7b41-3812-432f-a0bb-4cfb7c31827e
    type: derived

What it detects

This rule flags events where a Fortinet FortiGate configuration update adds a firewall address object (cfgpath: firewall.address, action: Add). Attackers and administrators may use address objects to stage access changes or prepare subsequent firewall policy modifications. It relies on FortiGate event telemetry that records configuration object attribute changes, including the action and configuration path.

Known false positives

An address could be added or deleted for legitimate purposes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.