Anomalous Telnet (port 23) scanning consistent with Mirai/CVE-2026-41940
Detects anomalous Telnet (TCP port 23) traffic associated with Mirai-variant botnet propagation, such as scanning for new targets or inbound compromise attempts, often following cPanel/WHM vulnerabilities.
Microsoft Sentinel (KQL)

