Detection of Anomalous SonicWall Remote Access Logins

This brief outlines a detection capability designed to identify anomalous remote access behavior on SonicWall firewalls. By leveraging a 14-day history window, the logic flags successful logins by administrators or remote users from source IP addresses that have not been previously associated with that specific user account on a particular appliance.

This detection is critical for identifying potential credential stuffing, account takeover (ATO), or the use of compromised administrative credentials to gain initial access to the network. As SonicWall appliances are frequent targets for credential-based attacks, distinguishing legitimate travel or ISP address rotations from adversary activity is a key challenge for security operations. The detection focuses on authentication events including administrator logins (codes 235, 236) and remote-user/SSL VPN logins (codes 237, 238, 1080).

Impact

Successful exploitation of compromised accounts via VPN or administrative portals allows threat actors to establish persistent access, perform internal reconnaissance, and deploy secondary payloads such as ransomware or data exfiltration tools. Failure to identify these anomalies increases the dwell time of attackers who utilize valid credentials to bypass traditional boundary defenses.

Recommendation

• Deploy the provided detection logic to flag first-seen user/source/appliance combinations for SonicWall environments.
• Establish a baseline for managed service provider (MSP) source IPs to minimize false positives in the 'new-terms' logic.
• Integrate MFA status checks into the triage workflow for all alerts generated by this rule; prioritize alerts where MFA failed or was absent.
• Review logs for concurrent suspicious activity including internal scanning, configuration changes, or unusual data transfer volumes from the tunnel address assigned to the newly identified user/IP pair.