Dahua Easy4IP Brute-Force LOGIN Opcode Flood (async_brute.py)
Detects high-frequency login attempts using the Dahua Easy4IP protocol. The rule flags multiple login opcode requests (identified by specific byte patterns 0xFF followed by 0x00A0) originating from the same source within a 60-second window, which is indicative of an automated brute-force or credential-stuffing attack targeting vulnerable IoT devices.
Suricata
