Active Remote Session Hijack Attempt Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•7

This rule detects an active remote session hijack attempt. It triggers when three or more TCP connections are established to the same destination within a 10-second window, originating from the internal network and destined for the internal network. This pattern could indicate an attempt to take over an existing network session.