Manthan Agravat
@manthan15011 follower4 downloads16 copies0 likes555 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
2
2
2
1
1
Platforms
2
Products / Services
2
1
1
1
1
MITRE Techniques
2
2
1
Detects 5 or more failed logins to a firewall management interface, followed immediately by a successful login for the same user and from the same IP.
This rule detects external brute-force attempts against firewall authentication mechanisms. It triggers when 15 or more failed login attempts from a single external IP address occur within a 15-minute window. The rule specifically filters for 'USER_LOGIN' events with a 'BLOCK' or 'FAIL' security result and excludes internal RFC1918 IP addresses to focus on external threats.