FortiGate User Group Modified via Edit Event
Alerts on FortiGate user group edits that can change access permissions, including VPN-related group membership.
FreeReviewedSigma · Medium · v2
- Product
- fortigate
- Service
- event
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2025-11-01
- Updated
- 2026-07-31
What it detects
This rule identifies when a Fortinet FortiGate firewall user group is modified, indicated by an event action of "Edit" and targeting the "user.group" configuration path. Changing group definitions can allow an attacker to adjust access controls, including potential access such as VPN permissions. It relies on FortiGate event telemetry that records the configuration change action and affected config path.
Reporting behind it
- fortiguard.comhttps://www.fortiguard.com/psirt/FG-IR-24-535
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
- docs.fortinet.comhttps://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
fortigate-user-group-edited-vpn-access-impact-69ffc84e
title: FortiGate User Group Modified via Edit Event
id: 127d7dbc-6f5b-4bcd-8327-025c9ea64ab0
status: experimental
description: This rule identifies when a Fortinet FortiGate firewall user group is modified, indicated by an event action of "Edit" and targeting the "user.group" configuration path. Changing group definitions can allow an attacker to adjust access controls, including potential access such as VPN permissions. It relies on FortiGate event telemetry that records the configuration change action and affected config path.
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
tags:
- attack.persistence
- attack.privilege-escalation
logsource:
product: fortigate
service: event
detection:
selection:
action: Edit
cfgpath: user.group
condition: selection
falsepositives:
- A group can be modified for legitimate purposes.
level: medium
license: DRL-1.1
related:
- id: 69ffc84e-8b1a-4024-8351-e018f66b8275
type: derived