Reasons
- Multiple stages of an attack chain were observed within a short time window.
- Further attacks within a short window, permanent ban applied based on indicators of persistence attacks.
MITRE ATT&CK Mappings
- Tactics: Initial Access
- Techniques: T1190
Evidence
- Nodes observed: 1
- Severity: HIGH
- TTL remaining: 5d 12h