Internal Lateral Movement via Remote Service
This rule detects internal lateral movement attempts within a network using remote services. It specifically looks for TCP traffic originating from and destined to the home network, indicating internal communication. A threshold of 10 connections within 30 seconds from the same source IP is used to identify suspicious activity, suggesting a potential brute-force or rapid connection attempt indicative of lateral movement.
Suricata
