Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful brute force attacks against Fortinet FortiManager administrative accounts.

Strategy

This rule monitors Fortinet FortiManager authentication logs for patterns indicating brute force attacks followed by successful compromise. The detection triggers when more than 4 failed admin login attempts are followed by at least one successful login for the same user account. This pattern suggests an attacker has successfully compromised an administrative account after multiple failed authentication attempts.

Triage & Response

• Verify if the successful login for {{@usr.name}} was legitimate by checking with the account owner or reviewing scheduled administrative activities.
• Examine the source IP addresses of both failed and successful login attempts to determine if they originated from expected locations.
• Review the timing between failed attempts and successful login to assess if the pattern indicates automated brute force activity.
• Check for any administrative actions performed by {{@usr.name}} immediately after the successful login to identify potential malicious activity.
• Determine if the compromised account has elevated privileges and assess the potential impact of unauthorized access.