Detect scanning traffic and unusual remote administrative access to SOHO/edge router management interfaces
scanning traffic targeting router admin ports, access from unexpected source IPs to router admin panel, unusual remote administrative logins to router management interface
Microsoft Sentinel (KQL)

