Possible CVE-2026-24061 Telnetd Auth Bypass
Detects the execution of the 'login' process with the '-f' flag, which skips authentication. When spawned by 'telnetd', this is a strong indicator of exploitation of CVE-2026-24061, a critical authentication bypass vulnerability.
Microsoft Sentinel (KQL)

