Virtual appliances have become the "black boxes" of the modern enterprise infrastructure. Organizations deploy FortiGate and similar firewall appliances with the assumption that their specialized nature provides inherent security. However, in our recent incident response engagements, we have seen threat actors increasingly target these appliances to establish persistent footholds, often bypassing traditional EDR visibility.
The core problem is visibility: you cannot install an agent on a FortiGate firewall. When these appliances are compromised or abused for command-and-control (C2), standard monitoring solutions often fail to capture the telemetry stored locally on the device. Recent research underscores the critical need for agentless threat detection—a methodology to map raw event logs extracted directly from appliance disks to real-world intrusion campaigns.
This post outlines the defensive posture required to detect malicious activity within virtual appliances, specifically focusing on extracting and analyzing FortiGate logs without disrupting production workloads.
Technical Analysis
The Blind Spot in Virtual Appliances
Virtual appliances run on hypervisors (VMware ESXi, AWS, Azure) and store critical operational data—such as system logs, configuration changes, and debug traces—within their virtual disk files. In the "Opening the Black Box" methodology, the focus shifts from network sampling to deep disk forensics.
- Affected Products: FortiGate FortiOS (Virtual Appliances), though the methodology applies broadly to Palo Alto, Cisco, and Check Point appliances.
- Attack Vector: adversaries exploit vulnerabilities or weak credentials to gain administrative access, then alter configurations or use the appliance as a pivot point.
- The Agentless Technique: Defenders can take a snapshot of the virtual appliance, mount the disk file (e.g.,
.vmdk,.vhd) read-only on an analysis jump box, and parse the internal filesystem structure. This allows access to log files that may have been rotated, deleted, or never forwarded to a centralized syslog server.
Log Sources and Forensic Artifacts
For FortiGate appliances, critical telemetry resides in specific directories on the filesystem:
/data/log/: Contains system, traffic, and event logs./var/log/: May contain kernel messages or crash dumps./sys_debug/: Stores trace files and debug output that can reveal exploit attempts or core dumps.
By analyzing these files offline, analysts can reconstruct the attack chain, identifying unauthorized configuration changes (e.g., creating new admin users, modifying firewall policies) or suspicious outbound connections that occurred before a log rotation policy wiped the evidence from the live system.
Detection & Response
Since this threat involves the exploitation of management interfaces and local log manipulation, detection relies on two vectors: analyzing centralized logs (if available) and performing agentless forensic hunts on disk snapshots.
Sigma Rules
The following Sigma rules detect suspicious activities in forwarded FortiGate logs (Syslog/CEF).
---
title: FortiGate Suspicious System Admin User Creation
id: 8f4c3d2e-1a0b-4c5d-9e6f-1a2b3c4d5e6f
status: experimental
description: Detects the creation of a new administrative user within FortiGate logs, a common persistence mechanism.
references:
- https://docs.fortinet.com/document/fortigate/7.4.0/log-message-reference/799698/log-message-reference
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1098
logsource:
product: fortigate
service: fortigate-system
detection:
selection:
type: 'utm'
subtype: 'configuration'
msg|contains:
- 'config system admin'
- 'edit '
- 'set passwd'
condition: selection
falsepositives:
- Legitimate administrative changes during maintenance windows
level: high
---
title: FortiGate Execution of Suspicious Shell Commands
id: 2b5e6f1a-9c8d-4e7f-b3a2-5c6d7e8f9a0b
status: experimental
description: Detects execution of shell commands or debug tools via FortiGate CLI, potentially indicating exploit usage or backdoor installation.
references:
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059
logsource:
product: fortigate
service: fortigate-system
detection:
selection:
msg|contains:
- 'execute ssh'
- 'execute telnet'
- 'execute factory-reset'
- 'execute bash'
condition: selection
falsepositives:
- Authorized debugging by network administrators
level: medium
KQL (Microsoft Sentinel)
This query hunts for evidence of administrative modification or potential compromise indicators within ingested FortiGate syslog data.
// Hunt for suspicious administrative modifications in FortiGate logs
Syslog
| where DeviceVendor == "Fortinet"
| extend msg = coalesce(SyslogMessage, Message)
| parse msg with * "type=" type: string "," * "subtype=" subtype:string "," * "msg=" msg_text:string
| where type == "utm" and subtype == "configuration"
| where msg_text has "config system admin" or msg_text has "set status enable" or msg_text has "set accprofile"
| project TimeGenerated, DeviceName, type, subtype, msg_text
| summarize count() by DeviceName, bin(TimeGenerated, 1h)
| order by count_ desc
Velociraptor VQL
This Velociraptor artifact is designed to run on an analysis workstation where a virtual appliance disk (e.g., a forensic snapshot) has been mounted. It performs agentless hunting by scanning the mounted filesystem for FortiGate log files and searching for IOCs.
-- Agentless Hunt: Scan mounted FortiGate snapshot for suspicious log entries
LET MountedPath = '/mnt/fortigate_snapshot'
-- Recursively find log files in the data/log directory
SELECT FullPath, Size, Mtime
FROM glob(globs=MountedPath + '/**/*.log')
WHERE FullPath =~ '/data/log/' OR FullPath =~ '/var/log/'
-- Parse lines for signs of admin user creation or modification
SELECT FullPath, Line
FROM foreach(
SELECT FullPath FROM glob(globs=MountedPath + '/**/*.log')
WHERE FullPath =~ '/data/log/'
)
SELECT * FROM parse_lines(filename=FullPath)
WHERE Line =~ 'config system admin'
OR Line =~ 'edit .*'
OR Line =~ 'set passwd'
Remediation Script (Bash)
This Bash script is intended for a Jump Box / Forensic Workstation. It automates the extraction and validation of logs from a mounted FortiGate virtual disk, enabling analysts to verify integrity without logging into the potentially compromised appliance itself.
#!/bin/bash
# Agentless FortiGate Log Extractor & Validator
# Usage: ./check_fortigate_snapshot.sh /path/to/mounted/snapshot
MOUNT_POINT="$1"
LOG_DIR="$MOUNT_POINT/data/log"
OUTPUT_DIR="./fortigate_analysis"
if [ -z "$MOUNT_POINT" ]; then
echo "Usage: $0 <path_to_mounted_snapshot>"
exit 1
fi
if [ ! -d "$LOG_DIR" ]; then
echo "[!] Log directory not found at $LOG_DIR. Check mount path."
exit 1
fi
mkdir -p "$OUTPUT_DIR"
echo "[*] Extracting FortiGate logs from $LOG_DIR..."
cp -r "$LOG_DIR"/* "$OUTPUT_DIR/"
echo "[*] Searching for suspicious admin modifications..."
grep -rn "config system admin" "$OUTPUT_DIR/" | tee "$OUTPUT_DIR/suspicious_admin_changes.txt"
echo "[*] Searching for failed login attempts..."
grep -rn "login failed" "$OUTPUT_DIR/" | tee "$OUTPUT_DIR/login_failures.txt"
echo "[*] Analysis complete. Results saved to $OUTPUT_DIR"
echo "[!] Review suspicious_admin_changes.txt for persistence indicators."
Remediation
If malicious activity is detected via agentless hunting, immediate containment is required:
- Snapshot Preservation: Before taking any action, create a full memory and disk snapshot of the affected appliance for forensic analysis.
- Credential Reset: Assume all cached credentials on the appliance are compromised. Rotate admin passwords and associated API tokens immediately.
- Config Verification: Restore the firewall configuration from a known-good backup created prior to the intrusion window. Manually audit the running configuration (
show full-configuration) against the backup to identify unauthorized IPsec tunnels, VPN users, or policy modifications. - Isolation: If the appliance acts as a pivot point, isolate it from the management network while maintaining traffic flow if critical for operations, or failover to a standby clean appliance.
- Patch Management: Apply the latest FortiOS security patches. Regularly scheduled maintenance windows should be established for patching virtual appliances, as they are frequently neglected compared to general-purpose servers.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.