Check Point IKEv1 Remote Access Exploitation Precondition
This rule looks for signs that someone is abusing an older Check Point VPN login method that has known security flaws. Successful abuse can give remote access without proper credentials. Patch and monitor VPN gateways if this appears. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
