Default Credential Login Attempt on Telnet

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects attempts to log in to a Telnet server using the default credential 'admin'. It specifically looks for the string 'admin' in TCP traffic directed to the HOME_NET on port 23 (Telnet). A threshold of 3 attempts within 30 seconds from the same source IP triggers the alert, indicating a potential brute-force or default credential attack.