Login Originating from Known Pentesting Platform
This detection rule identifies logins originating from suspicious remote systems commonly associated with penetration testing or malicious activity. These systems may include Kali Linux, Parrot OS, BlackArch, or other offensive security distributions. Such platforms are often used for reconnaissance, exploitation, credential harvesting, or lateral movement. The rule leverages indicators like unusual hostnames, known IP ranges, remote access patterns, or user agent strings to detect potentially unauthorized or anomalous access from these environments.
YARA-L
