Abnormal number of Connections on Telnet ports
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Increased number of connections on telnet ports may be indicative of a malicious entity attempting to leverage telnet vulnerabilities.
Severity
Trouble
Rule Requirement
Criteria
abnormal_telnet_port_connections_e1:
DEST_PORT in (23, 2323, 992) and IENAME = "Traffic Allowed"
| groupby SOURCE_IP
| groupby DEST_IP having count > 100
select abnormal_telnet_port_connections_e1.SOURCE_IP as SourceIP, count(abnormal_telnet_port_connections_e1.SOURCE_IP) as Count_of_SourceIP
Detection
Execution Mode
scheduled
Log Sources
Network
