Data Source: SonicWall | Detection.FYI

Multiple SonicWall Login Failures Followed by Successful Login

Jul 31, 2026 · Domain: Network Domain: Identity Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Credential Access Tactic: Initial Access Data Source: SonicWall Resources: Investigation Guide ·
Share on:

Identifies multiple failed SonicWall authentication attempts against several user accounts from one source IP, followed by a successful remote-access login from the same source to the same appliance. This may indicate successful password spraying, credential stuffing, or password guessing.

Read More
Accepted Default Telnet Port Connection

Jul 17, 2026 · Domain: Endpoint Use Case: Threat Detection Tactic: Command and Control Tactic: Lateral Movement Tactic: Initial Access Data Source: Fortinet Data Source: PAN-OS Data Source: pfSense Data Source: SonicWall Data Source: Suricata Resources: Investigation Guide ·
Share on:

This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.

Read More