LoFP / vpn ssl settings can be changed for legitimate purposes.

Techniques

• t1133

Sample rules

FortiGate - VPN SSL Settings Modified

• source: sigma
• technicques:
  • t1133

Description

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

Detection logic

condition: selection
selection:
  action: Edit
  cfgpath: vpn.ssl.settings