FortiGate User Group Edited (VPN Access Impact)

Alerts on FortiGate user group edits that can change access permissions, including VPN-related group membership.

FreeUnreviewedSigmamediumv1

fortigate-user-group-edited-vpn-access-impact-69ffc84e

title: FortiGate User Group Edited (VPN Access Impact)
id: 127d7dbc-6f5b-4bcd-8327-025c9ea64ab0
status: experimental
description: This rule flags FortiGate events where a user group configuration is edited. Changing group settings can affect which users are allowed access to protected services, including potential VPN-related permissions. The detection relies on FortiGate event telemetry indicating an 'Edit' action for the user.group configuration path.
references:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
tags:
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: fortigate
  service: event
detection:
  selection:
    action: Edit
    cfgpath: user.group
  condition: selection
falsepositives:
  - A group can be modified for legitimate purposes.
level: medium
license: DRL-1.1
related:
  - id: 69ffc84e-8b1a-4024-8351-e018f66b8275
    type: derived

What it detects

This rule flags FortiGate events where a user group configuration is edited. Changing group settings can affect which users are allowed access to protected services, including potential VPN-related permissions. The detection relies on FortiGate event telemetry indicating an 'Edit' action for the user.group configuration path.

Known false positives

A group can be modified for legitimate purposes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.