How do you detect Fortinet FortiGate exploitation?

Detect FortiGate exploitation by combining daemon, request and change signals. Watch for sslvpnd crashes and restarts near bursts of malformed requests, which fits memory-corruption flaws such as CVE-2024-21762. Then audit the configuration: alert on new admins or local users, new firewall policies, VPN tunnels or static routes, and admin logins from outside management ranges. Check for new outbound connections from the appliance. During response, compare the running config to a known-good backup, restrict or disable SSL-VPN, apply vendor integrity guidance and rotate stored credentials.

Detecting Fortinet FortiOS and FortiGate Exploitation

FortiOS SSL-VPN vulnerabilities have been exploited in the wild, with CVE-2024-21762, an out-of-bounds write in the SSL-VPN daemon reachable with crafted requests, as the leading example (T1190). Memory-corruption exploits are noisy for the daemon and quiet for everything else, so we combine crash signals, request patterns and, most importantly, configuration and account change auditing.

Signals at a Glance

Signal	Where	ATT&CK
sslvpnd crash, restart or watchdog events	FortiOS event and system logs	T1190
Unexpected admin or local user creation, or API admin profile changes	FortiOS event logs (config)	T1136.001
New firewall policy, VPN tunnel or static route outside change windows	FortiOS event logs (config)	T1562.004
Admin login from outside management ranges or from the SSL-VPN interface	FortiOS event logs	T1078
Burst of malformed or oversized requests to SSL-VPN endpoints followed by a crash	Web proxy, IDS, traffic logs	T1190
Appliance outbound connections to unfamiliar hosts	Traffic logs, flow	T1071.001

Configuration and Account Change Auditing

Attackers who gain control of a FortiGate usually make changes that persist: a new admin or VPN user, a policy that allows their traffic, or a changed tunnel. FortiOS records these as configuration events with the acting user, the interface and the object path. Forward them and alert on any change that does not match a ticket.

// Sentinel (KQL) - FortiGate config and admin events outside change windows
CommonSecurityLog
| where DeviceVendor =~ "Fortinet"
| extend logdesc = tostring(extract(@'logdesc="([^"]+)"', 1, AdditionalExtensions))
| where logdesc in~ ("Object attribute configured", "Attribute configured",
                     "Object configured", "Admin login successful", "Admin login failed")
      or Message has_any ("cfgpath", "cfgattr")
| extend cfgpath = tostring(extract(@'cfgpath="([^"]+)"', 1, AdditionalExtensions))
| where cfgpath has_any ("system.admin", "user.local", "firewall.policy", "vpn.ssl", "router.static")
        or logdesc has "Admin login"
| project TimeGenerated, DeviceName, SourceIP, SourceUserName, logdesc, cfgpath, Message
// Tune/validate: field names and extraction depend on your FortiOS version and CEF mapping.

A second query focuses on the daemon itself. Crash and restart events for the SSL-VPN process near unusual request bursts are a strong precursor signal, though absence of a crash does not prove safety:

index=network sourcetype="fortinet:fortigate:event"
  (sslvpnd OR "ssl vpn" OR "daemon") (crash OR "signal 11" OR restart OR segfault OR "watchdog")
| stats count min(_time) as first max(_time) as last by host, msg
| eval first=strftime(first,"%F %T"), last=strftime(last,"%F %T")
| sort - count
# Tune/validate: message text differs between FortiOS releases.

Triage and Response

Compare the running configuration to your last known-good backup and review every difference, not only admin accounts. Persistence has included changes that look like routine settings.
Use Fortinet’s published advisories and their guidance for integrity and compromise checks, and keep the appliance on a supported build.
Disable SSL-VPN or restrict it to known source ranges while you investigate. Where it is not needed, leave it off.
Rotate local credentials, VPN user passwords, pre-shared keys, certificates and any LDAP or RADIUS bind secrets stored on the device.
Review internal authentication logs for the appliance’s service accounts, and for logons from VPN address pools that do not match any real user.

Vetted sources

Use Fortinet PSIRT advisories and integrity-check guidance, CISA and national CERT advisories on FortiOS exploitation, SigmaHQ and Elastic rules for network device administration, and Splunk ESCU analytics where available. Baseline your own environment: legitimate admins, automation and SD-WAN tooling all generate configuration events.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Configuration and Account Change Auditing

Triage and Response

Build Detections That Fire

Edge Device & Web Shell Detection

Detection Hub

VPN Appliance Exploitation Detection

DMZ Outbound Anomaly Detection