Recon Scanning Against Firewall Management Interfaces

Ankit Mehta@Secvyn

•updated 27 days ago•3•0•10

Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.