Data Source: Suricata

Accepted Default Telnet Port Connection

Jan 27, 2026 · Domain: Endpoint Use Case: Threat Detection Tactic: Command and Control Tactic: Lateral Movement Tactic: Initial Access Data Source: PAN-OS Data Source: Fortinet Data Source: SonicWall Data Source: Suricata Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.

Newly Observed High Severity Suricata Alert

Jan 23, 2026 · Use Case: Threat Detection Rule Type: Higher-Order Rule Resources: Investigation Guide Domain: Network Data Source: Suricata ·

Share on:

This rule detects Suricata high severity alerts that are observed for the first time in the previous 5 days of alert history. Analysts can use this to prioritize triage and response.

Suricata and Elastic Defend Network Correlation

Jan 23, 2026 · Domain: Endpoint Domain: Network OS: Linux OS: Windows OS: macOS Use Case: Threat Detection Tactic: Command and Control Data Source: Elastic Defend Data Source: Suricata Resources: Investigation Guide ·

Share on:

This detection correlates Suricata alerts with Elastic Defend network events to identify the source process performing the network activity.

React2Shell Network Security Alert

Dec 19, 2025 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: PAN-OS Data Source: Fortinet Data Source: Suricata Data Source: Cisco FTD Resources: Investigation Guide ·

Share on:

This rule identifies network security alerts related to CVE-2025-55182 exploitation attempts from different network security integrations. CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor.