SonicWall SMA1000 / VPN — Brute Force Followed by Success (Credential Stuffing --- Exploit Chain)

Ankit Mehta@Secvyn

•updated Aug 10, 2026•3•0•11

This rule detects potential credential stuffing or brute force attacks against a SonicWall VPN device. It identifies scenarios where a single source IP experiences multiple failed authentication attempts within a 15-minute window, followed by at least one successful authentication on the same destination host.