IoT Telnet/SSH brute-force credential scanning by bot agent
Detects a single host rapidly initiating outbound Telnet (port 23) or SSH (port 22) connection attempts against a large number of distinct remote IP addresses in a short window. This behavior is indicative of bot-agent scanners, such as those associated with IoT botnets, attempting to propagate by performing brute-force login attempts using default credential pairs.
Microsoft Sentinel (KQL)
