Default Admin Credential Login on Web Interface

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•3

This rule detects attempts to log in to a web interface using default 'admin' credentials. It specifically looks for HTTP POST requests to a URI containing 'login' and a client body that contains 'admin' twice, indicating both username and password might be 'admin'.