Anomalous Telnet (port 23) scanning consistent with Mirai/CVE-2026-41940

Detects anomalous Telnet (TCP port 23) traffic associated with Mirai-variant botnet propagation, such as scanning for new targets or inbound compromise attempts, often following cPanel/WHM vulnerabilities.

Microsoft Sentinel (KQL)