FortiGate VPN SSL Settings Edited via Event Logs

Flags FortiGate VPN SSL settings being edited, which may indicate changes to SSL VPN access or authentication configuration.

FreeUnreviewedSigmamediumv1

fortigate-vpn-ssl-settings-edited-via-event-logs-8b5dacf2

title: FortiGate VPN SSL Settings Edited via Event Logs
id: 86d95efe-9d43-456a-b3d4-e5e82ac83d6a
status: experimental
description: This rule matches FortiGate events where the action is "Edit" and the configuration path is "vpn.ssl.settings," indicating that VPN SSL settings were modified. Attackers can change these settings to alter authentication behavior or related access controls, supporting persistence or initial access. Detection relies on FortiGate event telemetry that records the edit action and the targeted configuration path (cfgpath).
references:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  product: fortigate
  service: event
detection:
  selection:
    action: Edit
    cfgpath: vpn.ssl.settings
  condition: selection
falsepositives:
  - VPN SSL settings can be changed for legitimate purposes.
level: medium
license: DRL-1.1
related:
  - id: 8b5dacf2-aeb7-459d-b133-678eb696d410
    type: derived

What it detects

This rule matches FortiGate events where the action is "Edit" and the configuration path is "vpn.ssl.settings," indicating that VPN SSL settings were modified. Attackers can change these settings to alter authentication behavior or related access controls, supporting persistence or initial access. Detection relies on FortiGate event telemetry that records the edit action and the targeted configuration path (cfgpath).

Known false positives

VPN SSL settings can be changed for legitimate purposes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.