Home/CVE-2005-3057/Sigma rules
Sigma

Sigma rules for CVE-2005-3057

7 rules · scoped to cve · back to CVE-2005-3057
Direct rules mention this entity in their title or description. Related rules cover the techniques this entity is known to use.
◈

Detection rules

7 of 7
direct medium
FortiGate - New Firewall Policy Added
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
status experimental author Marco Pedrinazzi @pedrinazziM (InTheCyber) id f24ab7a8-f09a-4319-82c1-915586aa642b license Sigma · DRL-1.1
view Sigma YAML 
title: FortiGate - New Firewall Policy Added
id: f24ab7a8-f09a-4319-82c1-915586aa642b
status: experimental
description: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
date: 2025-11-01
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Add'
        cfgpath: 'firewall.policy'
    condition: selection
falsepositives:
    - A firewall policy can be added for legitimate purposes.
level: medium
direct medium
FortiGate - New Local User Created
Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.
status experimental author Marco Pedrinazzi @pedrinazziM (InTheCyber) id ddbbe845-1d74-43a8-8231-2156d180234d license Sigma · DRL-1.1
view Sigma YAML 
title: FortiGate - New Local User Created
id: ddbbe845-1d74-43a8-8231-2156d180234d
status: experimental
description: |
    Detects the creation of a new local user on a Fortinet FortiGate Firewall.
    The new local user could be used for VPN connections.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
date: 2025-11-01
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Add'
        cfgpath: 'user.local'
    condition: selection
falsepositives:
    - A local user can be created for legitimate purposes. Investigate the user details to determine if it is authorized.
level: medium
direct medium
FortiGate - Firewall Address Object Added
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
status experimental author Marco Pedrinazzi @pedrinazziM (InTheCyber) id 5c8d7b41-3812-432f-a0bb-4cfb7c31827e license Sigma · DRL-1.1
view Sigma YAML 
title: FortiGate - Firewall Address Object Added
id: 5c8d7b41-3812-432f-a0bb-4cfb7c31827e
status: experimental
description: Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
date: 2025-11-01
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Add'
        cfgpath: 'firewall.address'
    condition: selection
falsepositives:
    - An address could be added or deleted for legitimate purposes.
level: medium
direct medium
FortiGate - New Administrator Account Created
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
status experimental author Marco Pedrinazzi @pedrinazziM (InTheCyber) id cd0a4943-0edd-42cf-b50c-06f77a10d4c1 license Sigma · DRL-1.1
view Sigma YAML 
title: FortiGate - New Administrator Account Created
id: cd0a4943-0edd-42cf-b50c-06f77a10d4c1
status: experimental
description: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
date: 2025-11-01
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Add'
        cfgpath: 'system.admin'
    condition: selection
falsepositives:
    - An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized.
level: medium
direct medium
FortiGate - User Group Modified
Detects the modification of a user group on a Fortinet FortiGate Firewall. The group could be used to grant VPN access to a network.
status experimental author Marco Pedrinazzi @pedrinazziM (InTheCyber) id 69ffc84e-8b1a-4024-8351-e018f66b8275 license Sigma · DRL-1.1
view Sigma YAML 
title: FortiGate - User Group Modified
id: 69ffc84e-8b1a-4024-8351-e018f66b8275
status: experimental
description: |
    Detects the modification of a user group on a Fortinet FortiGate Firewall.
    The group could be used to grant VPN access to a network.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
date: 2025-11-01
tags:
    - attack.persistence
    - attack.privilege-escalation
    # - attack.t1098.007
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Edit'
        cfgpath: 'user.group'
    condition: selection
falsepositives:
    - A group can be modified for legitimate purposes.
level: medium
direct medium
FortiGate - VPN SSL Settings Modified
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.
status experimental author Marco Pedrinazzi @pedrinazziM (InTheCyber) id 8b5dacf2-aeb7-459d-b133-678eb696d410 license Sigma · DRL-1.1
view Sigma YAML 
title: FortiGate - VPN SSL Settings Modified
id: 8b5dacf2-aeb7-459d-b133-678eb696d410
status: experimental
description: |
    Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
    This behavior was observed in pair with the addition of a VPN SSL Web Portal.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
date: 2025-11-01
tags:
    - attack.persistence
    - attack.initial-access
    - attack.t1133
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Edit'
        cfgpath: 'vpn.ssl.settings'
    condition: selection
falsepositives:
    - VPN SSL settings can be changed for legitimate purposes.
level: medium
direct medium
FortiGate - New VPN SSL Web Portal Added
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.
status experimental author Marco Pedrinazzi @pedrinazziM (InTheCyber) id 2bfb6216-0c31-4d20-8501-2629b29a3fa2 license Sigma · DRL-1.1
view Sigma YAML 
title: FortiGate - New VPN SSL Web Portal Added
id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2
status: experimental
description: |
    Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
    This behavior was observed in pair with modification of VPN SSL settings.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi @pedrinazziM (InTheCyber)
date: 2025-11-01
tags:
    - attack.persistence
    - attack.initial-access
    - attack.t1133
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Add'
        cfgpath: 'vpn.ssl.web.portal'
    condition: selection
falsepositives:
    - A VPN SSL Web Portal can be added for legitimate purposes.
level: medium
Showing 1-7 of 7
Prev 1 Next
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin