SonicWall - Allowed SSH, Telnet, and RDP Connections

This rule identifies allowed inbound SSH, Telnet, and RDP connections. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall).

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 14 ATT&CK techniques it maps to.
Log source product: cef cefama sonicwallfirewall
Log source service: asimnetworksessionsonicwallfirewall commonsecuritylog

Detection rules

SonicWall - Allowed SSH, Telnet, and RDP Connections

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules