LoFP / new administrators or vpn users, travel, mobile networks, isp address rotation, managed service providers, and first observations after integration onboarding or retention loss can trigger this rule.

Techniques

• T1078
• T1133

Sample rules

First Seen SonicWall Remote Access Login by User and Source

• source: elastic
• technicques:
  • T1078
  • T1133

Description

Identifies a successful SonicWall VPN- or WAN-zone administrator or remote-user login from a source IP that was not previously observed with the same user on the same appliance during the prior 14 days. This may indicate stolen credentials, compromised administrator access, or unauthorized remote access.

Detection logic

data_stream.dataset:"sonicwall_firewall.log" and
  event.action:"login-success" and
  event.code:("235" or "236" or "237" or "238" or "1080") and
  source.ip:* and user.name:* and observer.serial_number:*