LoFP / a vpn ssl web portal can be added for legitimate purposes.

Techniques

• t1133

Sample rules

FortiGate - New VPN SSL Web Portal Added

• source: sigma
• technicques:
  • t1133

Description

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

Detection logic

condition: selection
selection:
  action: Add
  cfgpath: vpn.ssl.web.portal