Tag
AWS Discovery API Calls from VPN ASN by New Identity
2 rules 1 TTPThis rule detects the initial use of AWS discovery APIs from VPN-associated ASNs by a previously unseen identity, indicating potential reconnaissance activity.
OpenVPN-auth-oauth2 Authentication Bypass in Plugin Mode
2 rules 1 TTPA critical authentication bypass vulnerability exists in openvpn-auth-oauth2 versions 1.26.3 through 1.27.2 when deployed in the experimental plugin mode; clients that do not support WebAuth/SSO are incorrectly granted VPN access without completing OIDC authentication.
Synology SSL VPN Client Plaintext Password Storage Vulnerability (CVE-2021-47961)
2 rules 1 TTP 1 CVESynology SSL VPN Client before 1.4.5-0684 stores passwords in plaintext, allowing remote attackers to potentially access or manipulate user PIN codes, leading to unauthorized VPN configuration and traffic interception.
Fortigate VPN CVE-2023-27997 Exploitation Attempt
2 rules 1 TTP 1 IOCIDS alerts indicate a potential exploitation attempt against a Fortigate VPN server using CVE-2023-27997, characterized by repeated GET requests to the /remote/logincheck endpoint originating from a specific IPv6 address.
Fortigate VPN Exploit Attempt via CVE-2023-27997 and Suspicious User-Agent
3 rules 2 TTPs 3 IOCsMultiple IDS alerts indicate potential exploitation attempts against Fortigate VPN servers using CVE-2023-27997, alongside traffic from a suspicious user agent, possibly indicating reconnaissance or exploit activity.