Opening the Black Box: Agentless Threat Detection for Virtual Appliances

What it is

A threat-hunting playbook for detecting post-exploitation activity on FortiGate NGFW virtual appliances by parsing local FortiOS logs that aren't normally streamed. The summary already names the CVEs, campaigns, and the headline log IDs (32001/32002/44547/41987); what it can't carry is the concrete detection detail — the specific field values, additional log IDs, and IOCs that make the hunts runnable. That's below.

Detection specifics beyond the summary

Credential stuffing (Initial Access)

• Log ID 32002 "Admin login failed" — inspect reason (name_invalid, passwd_invalid, mfa_failed) and ui (GUI(1.2.3.4), SSH(1.2.3.4)).
• Log ID 32003 "Admin login disabled" — account lockout, signals brute-force in progress.
• May 2026 Wiz-observed campaign: botnet of 78+ shared IPs from Eastern European VPS, commercial VPNs, and residential proxies. Hunt logins targeting default accounts admin, support, backup, root.

Rogue admin creation (Persistence)

• Log ID 44547 "Object attribute configured" — for account creation look for cfgpath=system.admin, action=Add. Malicious pattern in cfgattr: accprofile[super_admin], two-factor[disable], trusthost1[0.0.0.0 255.255.255.0] (any-IP access + no MFA).
• Correlate with 32001 within 15 minutes to tie the new account to its creating session.
• CVE-2026-24858 observed chain: SSO login via built-in sys_sso_forticloud_admin with disposable email support@openmail.pro, then creation of backupadmin (super_admin, no MFA, trusthost 0.0.0.0/0) within minutes.

Suspicious SSO email domains

• Observed IOCs: cloud-init@mail.io, cloud-noc@mail.io, and *@tutamail.com, *@openmail.pro, *@protonmail.com.
• FortiManager-pushed SSO creation logged as 0021030002 "CDB event log for object changed" with type=sys_sso_forticloud_admin, key=email.

Certificate manipulation

• Log ID 41987 "Certificate updated" — cert-type Local vs CA, reason=acme distinguishes auto-renewal from manual/attacker uploads; 41990 = update failed (trial-and-error). Also 44547 on vpn.certificate.local (includes private keys) / vpn.certificate.ca.

NAT/port-forwarding abuse

• Log ID 44547 on firewall.vip — watch cfgattr for extip, mappedip (external/C2), mappedport in {22, 3389, 445, 1433, 3306, 5432}, portforward[enable]. Also 44546 "Configuration changed" for bulk imports.

Config exfiltration (Defense Evasion)

• Log ID 32095 "Admin performed an action from GUI" — action="download", msg "System config file has been downloaded". FortiOS stores credentials with reversible encryption, so a dumped config yields LDAP binds, VPN PSKs, and cert private keys in cleartext.
• AWS-documented campaign: 600+ devices across 55+ countries, AI-assisted Python to decrypt configs at scale, then DCSync. SentinelOne case: ssl-admin account → show full-configuration → decrypted fortidcagent LDAP creds → AD auth, all within 10 minutes.

FortiManager script abuse (Lateral Movement)

• Log ID 32052 "Upload and run a script" — ui="fgfmd" confirms it came from FortiManager; msg holds script ID (not content). Log ID 44548 "Action performed" logs the actual CLI command in msg. Hunt scripts with ../, shell commands, or /bin/, /tmp references. UNC3886 used this path with CVE-2022-41328 to drop CASTLETAP.

C2 / network hunting

• CASTLETAP (/bin/fgfm) used ICMP port knocking for C2; because it originates from the firewall it appears in subtype="local" (not subtype="forward"). Hunt ICMP (proto=1) from the FortiGate to external IPs.
• Device-behavior anomalies via devtype/osname fields (e.g., a Printer initiating SSH).

Preconditions

Detection requires Wiz Defend Agentless Workload Detection, enabled through the Preview Hub — no agent on the appliance. Device-type hunting needs FortiGate device detection enabled. Applies to FortiGate virtual appliances (present in 12% of cloud environments per the post).

Caveats

The page states no public report documents attackers uploading malicious certificates — that hunt rests on IR-advisory recommendations (IBM X-Force, Beazley, S-RM) to rotate certs post-compromise, not observed attacks.