a local user can be created for legitimate purposes. investigate the user details to determine if it is authorized.

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/network/fortinet/fortigate/fortinet_fortigate_new_local_user_created.yml>sigma
technicques: t1136 t1136.001

Techniques

Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.

condition: selection
selection:
  action: Add
  cfgpath: user.local