Abnormal number of Connections on Telnet ports
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Increased number of connections on telnet ports may be indicative of a malicious entity attempting to leverage telnet vulnerabilities.
Severity
Trouble
Rule Requirement
Criteria
abnormal_telnet_port_connections_e1: DEST_PORT in (23, 2323, 992) and IENAME = "Traffic Allowed" | groupby SOURCE_IP | groupby DEST_IP having count > 100 select abnormal_telnet_port_connections_e1.SOURCE_IP as SourceIP, count(abnormal_telnet_port_connections_e1.SOURCE_IP) as Count_of_SourceIP
Detection
Execution Mode
scheduled
Log Sources
Network
