VerdantBamboo: External Brute-Force Then Successful Login on Edge Appliance (T1078/T1133)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potentially malicious credential abuse patterns, such as credential stuffing or brute force attacks, originating from external IP addresses against edge appliance VPN or administrative interfaces. It identifies activity by correlating a high volume of failed authentication attempts followed by a successful login from the same external IP address.