LeakySensey: Mass internet-wide scan of PPTP/L2TP/SSH ports recon

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•1

This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.