Remote Service Access from External IP Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects a high volume of TCP SYN packets from an external IP address to the internal network, indicative of an attempted remote service access or port scan. Specifically, it triggers if 5 or more TCP SYN packets are observed from the same source IP within a 30-second window, targeting any port on the home network.