StrikeShark Mass Port Scan of Exchange/Openfire/FortiOS/GeoServer Perimeter
This rule detects potential scanning behavior (port or host sweeps) against specific, commonly targeted service ports (e.g., 443, 80, 8080) and correlates it with suspicious HTTP URI path requests associated with common exploit attempts (e.g., OWA, ECP, or management API paths).
Splunk (SPL)
