SOHO Hijack - SOHO Router Admin Brute-Force (T1110.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•13

Identifies a local device repeatedly attempting to access default router gateway IPs (192.168.1.1, 192.168.0.1, 10.0.0.1) on common web ports (80, 443) to brute-force admin passwords. The rule triggers if more than 20 attempts are observed within a one-minute window from a single device to a specific remote IP.