Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
Platforms
2
Products / Services
2
MITRE Techniques
2
2
2
CVEs
71
71
64
58
49
This rule detects potentially suspicious administrative activity on Check Point Security Management or Multi-Domain servers. It monitors the CommonSecurityLog for specific management-related activities ('command', 'cpm', 'cpca') originating from non-trusted IP ranges. This behavior is indicative of unauthorized management access or exploitation attempts targeting the administrative console of Check Point security appliances.
This rule detects potentially suspicious administrative activity on Check Point Security Management or Multi-Domain servers. It monitors the CommonSecurityLog for specific management-related activities ('command', 'cpm', 'cpca') originating from non-trusted IP ranges. This behavior is indicative of unauthorized management access or exploitation attempts targeting the administrative console of Check Point security appliances.
