FortiBleed IOC List and SIEM Detection Rules: Check Your Exposure

The FortiBleed dataset consists of VPN credentials extracted from 73,932 FortiGate firewall configuration files. The leaked records include the device management IP address, firmware version string, VPN portal URL, administrator usernames, and plaintext credentials scraped from the configuration export. The dataset does not include routing tables, ACLs, or other configuration details that would yield traditional network IOCs.

For defenders, this means there are no IP blocklists, no domain blocklists, and no file hashes to ingest. The threat is not a specific attacker infrastructure. It is the credential set itself, now circulating among threat actors who use it for credential stuffing against FortiGate VPN portals.

What does exist:

1. The Hudson Rock domain checker lets organizations query whether their managed domains appear in the leaked dataset, indicating that one or more of their FortiGate firewalls' credentials are exposed.

2. Firmware version exposure: the leaked records contain Fortinet firmware version strings. Devices running vulnerable firmware at the time of scraping may be included regardless of whether Hudson Rock surfaces the domain explicitly.

3. Behavioral IOCs: once attackers have the credential set, their use of it against your VPN portal generates authentication anomalies that SIEM rules can surface. These are the highest-value detection artifacts available for this leak.

Hudson Rock's Cavalier intelligence platform provides the only authorized domain exposure check for FortiBleed. The process is straightforward, but there are pitfalls that produce false negatives.

Since no static IOC list exists for FortiBleed, the detection surface is entirely behavioral. Attackers using FortiBleed credentials will attempt authentication against your VPN portal, and the authentication attempts generate log entries your SIEM can query against FortiGate SSL-VPN authentication logs.

Authentication burst from new source IP: A cluster of five or more authentication attempts within 60 seconds against your FortiGate SSL-VPN portal from an IP address not seen in the previous 30 days. Credential stuffing operations test large credential sets in rapid succession.

First-seen country authentication success: A successful VPN authentication from a country not in the user's prior 90-day authentication history. Buyers of the FortiBleed credential set are globally distributed and will test credentials without regard for the victim's geography.

Multiple account attempts from single source: More than three distinct username attempts from the same source IP within a 10-minute window. Credential stuffing tools without per-account delay logic produce this signature consistently.

Authentication success after extended inactivity: A successful VPN authentication for a user account that has shown no activity for more than 90 days. Stale credentials frequently survive rotation cycles and represent the highest-value targets in a credential stuffing campaign.

Off-hours success from new IP: Any successful authentication outside business hours from an IP address not previously associated with the user. Attackers purchasing leaked credentials operate in their own time zone, not the victim's.

The following detection logic targets the behavioral patterns most consistent with FortiBleed credential use against Fortinet SSL-VPN portals. These rules are written in generic Sigma format and require translation to your SIEM's query language using sigma-cli.

Rule 1: Authentication burst from new source

title: FortiGate SSL-VPN Credential Stuffing Burst status: experimental description: Rapid VPN auth attempts from a previously unseen IP, consistent with FortiBleed stuffing logsource: category: firewall product: fortinet detection: selection: eventid: '0100032003' timeframe: 60s condition: selection | count() by srcip > 5 falsepositives:

• VPN client reconnect storms after network interruption level: high tags:
• attack.credential_access
• attack.t1110.004

Rule 2: Multi-account spray from single source

title: FortiGate Multi-Account Credential Spray status: experimental logsource: category: firewall product: fortinet detection: selection: eventid|startswith: '010003' timeframe: 600s condition: selection | count(distinct username) by srcip > 3 level: high

Note: FortiGate event IDs vary by firmware version. Verify against your firmware's log ID reference before deploying. Both rules require a 30-day source IP baseline per user to suppress false positives from employees who travel or change ISPs.

Before running the Hudson Rock checker, verify whether your FortiGate management interfaces are internet-exposed at all. Internet-exposed FortiGate management interfaces compound FortiBleed risk because authenticated attackers can log in directly rather than only through the SSL-VPN portal.

Shodan query for FortiGate exposure by organization:

product:"FortiGate" org:"Your Organization Name"

or by IP range:

product:"FortiGate" net:203.0.113.0/24

A result that includes your organization's IPs and returns a FortiGate management interface means that interface is directly internet-exposed. The management interface should not be internet-routable. Restrict it to a management VLAN reachable only via out-of-band access or a separate administrative VPN with hardware token authentication.

Censys.io provides an alternative search with different crawl coverage if Shodan does not surface your devices. Use both for complete exposure verification.

If Hudson Rock confirms your domain is in the FortiBleed dataset, or if your device firmware was in the vulnerable range at scraping time, treat the exposure as confirmed and execute these steps.