LockBit VPN Edge Device Recon - High-Volume 403/404 Responses on VPN Login Paths
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Splunk (SPL)
