Successful login to SonicWall SSL-VPN from external source
Detects successful remote authentication events originating from an external source IP address via a SonicWall SSL-VPN, as identified by relevant login fields. This rule serves as a proxy for identifying initial access attempts often associated with ransomware activity, such as Akira, which leverage compromised VPN credentials.
SentinelOne
