Coverage › CVE-2019-5591
CVE-2019-5591 Mapped Sigma
Fortinet FortiOS Default Configuration Vulnerability
- Vendor / product
- Fortinet — FortiOS
- Description (CISA)
- Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
- Added to KEV
- 2021-11-03
- Due date
- 2022-05-03
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Known
- CWE
- CWE-306
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2019-5591
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1133 External Remote Services | exploitation technique | CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server. ref 1 |
live |
| T1005 Data from Local System | secondary impact | CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server. ref 1 |
live |
| T1557 Adversary-in-the-Middle | primary impact | CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1005 Data from Local System secondary impact
- DET0380 Detection of Local Data Collection Prior to Exfiltration
AN1070 WindowsAdversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.Tunable:
TargetFilePathRegexParentProcessFilterAN1071 LinuxAdversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.Tunable:TimeWindowScriptToolNameAN1072 macOSAdversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.Tunable:UserContextTargetVolumeAN1073 Network DevicesCollection of device configuration via CLI commands (e.g.,show running-config,copy flash,more), often followed by TFTP/SCP transfers.Tunable:CommandScopeAuthenticatedUserListAN1074 ESXiAdversaries accessing datastore or configuration files viavim-cmd,esxcli, or SCP to extract logs, VMs, or host configurations.Tunable:AccessPathRegexInteractiveShellUsage
Sigma rules tagged attack.t1005 (14)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Roberto Rodriguez @Cyb3rWard0g
· 2021-10-08 (modified 2023-11-30) · logsource: product=windows category=pipe_created · 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Author: TropChaud
· 2022-12-19 (modified 2023-01-19) · logsource: product=windows category=process_creation · 24c77512-782b-448a-8950-eddb0785fc71
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Author: frack113
· 2021-08-16 (modified 2023-05-04) · logsource: product=windows category=process_creation · 2f47f1fd-0901-466e-a770-3b7092834a1b
Detects a command used by conti to dump database
Author: frack113
· 2022-04-08 (modified 2023-01-19) · logsource: product=windows category=process_creation · 4833155a-4053-4c9c-a997-777fcea0baa7
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Author: Diogo Braz
· 2020-04-16 (modified 2022-10-05) · logsource: product=aws service=cloudtrail · 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-04 · logsource: product=windows category=process_creation · 696bfb54-227e-4602-ac5b-30d9d2053312
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Author: frack113
· 2022-02-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 6a69f62d-ce75-4b57-8dce-6351eb55b362
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe
Author: Jason Mull
· 2025-05-12 · logsource: product=windows service=system · 882fbe50-d8d7-4e29-ae80-0648a8556866
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Author: frack113
· 2021-12-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · b57ba453-b384-4ab9-9f40-1038086b4e53
Detects dump of credentials in VeeamBackup dbo
Author: Austin Clark
· 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a
Collect pertinent data from the configuration files
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
T1133 External Remote Services exploitation technique
- DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
AN1004 WindowsUnusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.WinEventLog:Application
VPN, Citrix, or remote access gateway logs showing external IP addresses→ DC0038 Application Log ContentTunable:BusinessHoursKnownRemoteIPsFailedLogonThresholdGeoIPWhitelistTimeWindowAN1005 LinuxRepeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).Tunable:KnownSSHClientsFailedLogonThresholdTimeWindowAN1006 macOSUnexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.macos:unifiedlogRemote login (ssh) or screen sharing authentication attempts→ DC0088 Logon Session MetadataTunable:KnownVNCServersTimeWindowAN1007 ContainersConnections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.ApplicationLog:APIDocker/Kubernetes API access from external sources→ DC0038 Application Log Contentkubernetes:auditUnauthorized container creation or kubelet exec logs→ DC0088 Logon Session MetadataTunable:AllowedCIDRsTimeWindow
Sigma rules tagged attack.t1133 (20)
Author: Josh Nickels, Qi Nan
· 2024-03-11 · logsource: product=linux category=process_creation · 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · 2bfb6216-0c31-4d20-8501-2629b29a3fa2
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-07 · logsource: product=windows category=process_creation · 6c76b3d0-afe4-4870-9443-ffe6773c5fef
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.
This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Author: Florian Roth (Nextron Systems)
· 2021-02-11 (modified 2024-02-26) · logsource: product=windows category=process_creation · 75bfe6e6-cd8e-429e-91d3-03921e1d7962
Detects ScreenConnect program starts that establish a remote access to a system.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · 8b5dacf2-aeb7-459d-b133-678eb696d410
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-27 (modified 2023-02-15) · logsource: product=windows category=file_delete · 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0
Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-27 · logsource: product=windows category=file_change · 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 (modified 2023-02-05) · logsource: product=windows category=process_creation · a4e3d776-f12e-42c2-8510-9e6ed1f43ec3
Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Josh Nickels, Qi Nan
· 2024-03-11 · logsource: product=windows category=process_creation · ab70c354-d9ac-4e11-bbb6-ec8e3b153357
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Author: frack113
· 2021-12-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · b64a026b-8deb-4c1d-92fd-98893209dff1
Running Chrome VPN Extensions via the Registry install 2 vpn extension
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
All 20 rules on the technique page →
T1557 Adversary-in-the-Middle primary impact
- DET0296 Detect Adversary-in-the-Middle via Network and Configuration Anomalies
AN0823 WindowsDetects suspicious DNS/ARP poisoning attempts, unauthorized modifications to registry/network configuration, or abnormal TLS downgrade activity. Correlates changes in system configuration with subsequent unusual network flows or authentication events.Tunable:
MonitoredRegistryPathsDowngradeCipherListTimeWindowAN0824 LinuxDetects unauthorized edits to /etc/hosts, /etc/resolv.conf, or suspicious ARP broadcasts. Correlates file modifications with subsequent unexpected network sessions or service creation.NSM:FlowUnexpected ARP replies or DNS responses inconsistent with authoritative servers→ DC0085 Network Traffic ContentTunable:MonitoredFilesARPThresholdAN0825 macOSDetects unauthorized edits to system configuration profiles, unexpected certificate trust changes, or abnormal ARP/DNS patterns indicative of interception.macos:unifiedlogConfiguration profile modified or new profile installed→ DC0038 Application Log ContentTunable:ProfileIdentifiersTLSVersionThresholdAN0826 Network DevicesDetects unauthorized firmware or configuration changes enabling adversary-in-the-middle positioning (e.g., route injection, DNS spoofing, SSL downgrade). Behavioral analytics focus on sudden changes to routing tables or image file integrity failures.networkdevice:configConfiguration file modified or replaced on network device→ DC0061 File ModificationTunable:RoutingPolicyBaselineFirmwareChecksum
Sigma rules tagged attack.t1557 (10)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-02 (modified 2026-03-16) · logsource: product=windows category=dns_query · 2074e137-1b73-4e2d-88ba-5a3407dbdce0
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 (modified 2026-03-16) · logsource: product=windows category=file_event · 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Author: Tim Brown
· 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=huawei service=bgp · a557ffe6-ac54-43d2-ae69-158027082350
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=juniper service=bgp · a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 · logsource: product=windows category=process_creation · bb0e87ce-c89f-4857-84fa-095e4483e9cb
Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.
Author: Janantha Marasinghe
· 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Author: hamid
· 2025-10-19 · logsource: product=windows service=system · d22df9cd-2aee-4089-93c7-9dc4eae77f2c
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-04-28 · logsource: product=azure service=signinlogs · ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios",
indicating potential use of automated credential harvesting or AiTM phishing infrastructure.
Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens.
When triaging results, analysts should:
- Check the sign-in risk level, MFA status, and conditional access results for signs of bypass.
- Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts.
- Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.