Telnet Default Credential Login Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects Telnet login attempts using the default credential 'admin'. It specifically looks for the string 'admin' (case-insensitive) in Telnet traffic flowing to the server. A threshold of 5 attempts within 60 seconds from the same source IP triggers the alert, indicating a potential brute-force or credential stuffing attack against Telnet services.