Administrative interfaces on perimeter devices are sensitive because successful authentication bypass can provide powerful configuration access. The source includes a focused hunt for Fortinet FortiOS and FortiProxy jsconsole authentication-bypass activity.

Coverage includes CVE-2024-55591 and CVE-2025-24472.

Detection Query

full_log:jsconsole and full_log:("Admin login successful" or "Administrator admin logged in successfully" or super_admin or "Add system.admin" or "Object attribute configured")

The query searches for jsconsole combined with indicators related to:

• successful administrator login;

• super_admin;

• creation or modification of system.admin;

• object attribute configuration.

The source recorded 12 matching events during the previous 30 days.

Why the Query Requires Context

The strings in the detection can also appear during legitimate administration. The presence of jsconsole and an administrator-related log entry should therefore be investigated rather than automatically classified as exploitation.

The main question is whether the activity matches an approved administrator, source address, change window, and configuration task.

Investigation Priorities

For each event, review:

• source IP;

• administrator account;

• device hostname;

• login timestamp;

• configuration changes;

• new administrator accounts;

• privilege changes;

• other authentication failures or successes nearby.

If the activity originated from an unusual source or produced unexpected administrator changes, the event should receive higher priority.

Correlation with Network and Configuration Telemetry

A strong investigation should correlate the log with firewall or VPN management activity.

Look for:

• newly created administrator objects;

• modifications to trusted hosts;

• configuration exports;

• policy changes;

• unexpected remote-access settings.

Tuning

Known administrative automation and approved management systems may produce repeatable patterns. These should be baselined using specific source IPs and accounts.

Avoid excluding the entire jsconsole context because unauthorized use of the same mechanism is exactly what the rule is intended to surface.

Operational Value

With only 12 matches in the source period, this query provides a manageable review set.

It is a good example of a product-specific hunt that uses device-native logs rather than endpoint process telemetry, which is often unavailable on security appliances.