FortiGate SSL VPN Settings Edited

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags FortiGate events where SSL VPN settings are edited, specifically changes under vpn.ssl.settings. Attackers may modify SSL VPN authentication-related configuration to establish or maintain remote access persistence. It relies on FortiGate event telemetry capturing an Edit action and the targeted configuration path.

Reporting behind it

Related detections9 linkedT1133 — drag to rearrange

SplashTop Network

Suspicious SoftEther VPN Hamcore Config Written to ProgramData (via file_event)

SplashTop Process

AnyDesk Network

OpenCanary RDP New Connection Attempt on Application Logtype 14001

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

FortiGate: Addition of VPN SSL Web Portal via Event Logs

Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

TeamViewer Remote Session Startup Command Execution on Linux

FortiGate SSL VPN Settings Edited

Pivot detection · T1133 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

fortigate-vpn-ssl-settings-edited-via-event-logs-8b5dacf2

title: FortiGate SSL VPN Settings Edited
id: 86d95efe-9d43-456a-b3d4-e5e82ac83d6a
status: experimental
description: This rule flags FortiGate events where SSL VPN settings are edited, specifically changes under vpn.ssl.settings. Attackers may modify SSL VPN authentication-related configuration to establish or maintain remote access persistence. It relies on FortiGate event telemetry capturing an Edit action and the targeted configuration path.
references:
  - https://www.fortiguard.com/psirt/FG-IR-24-535
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
  - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings
  - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2025-11-01
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  product: fortigate
  service: event
detection:
  selection:
    action: Edit
    cfgpath: vpn.ssl.settings
  condition: selection
falsepositives:
  - VPN SSL settings can be changed for legitimate purposes.
level: medium
license: DRL-1.1
related:
  - id: 8b5dacf2-aeb7-459d-b133-678eb696d410
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL