External VPN/RDP abuse via SSL-VPN default admin creds without lockout
Detects use of default SSL-VPN administrator credentials from external or unusual source geographies after production provisioning, where account-lockout controls are absent — the initial-access vector observed in Gunra intrusions.
Microsoft Sentinel (KQL)
