Dahua CVE-2021-33044/33045 auth bypass admin access (CameraSwarm)
Detects anomalous activity on Dahua camera management interfaces (port 37777) where multiple failed authentication attempts are followed by administrative configuration actions without a corresponding successful credentialed login, suggesting exploitation of authentication-bypass vulnerabilities such as CVE-2021-33044 and CVE-2021-33045.
Microsoft Sentinel (KQL)

