Firewall/VPN Console Probing (fwprobe)

Firewall/VPN Console Probing

Requests match known firewall, VPN, and gateway admin/login surfaces or client artifacts, indicating explicit probing of security-device endpoints.

Attack family · Security appliance reconnaissance Phase · Perimeter discovery and initial access Risk · Critical

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.

Focus

Firewall, VPN, and gateway admin surfaces
Vendor-specific security-device portals and APIs
Client artifacts that look like security-device probing

Logic

Strong path hits for Fortinet, Palo Alto, Cisco, F5, Pulse/Ivanti, and similar products emit on their own.
Known VPN/firewall client user-agents also emit directly.
Generic firewall or VPN hints only upgrade when several weak clues appear together.

Attack Family

Security appliance reconnaissance

Phase · Perimeter discovery and initial access Risk · Critical

Exposed firewall, VPN, and gateway consoles are high-value targets because they sit at trust boundaries. When attackers find them, the payoff can be domain access, remote footholds, and rapid enterprise spread.

Damage Patterns

Compromised VPN and firewall portals can lead directly to privileged network access, credential theft, and post-auth lateral movement.
The damage is often outsized because a perimeter device can collapse segmentation and visibility at once.

Incident Lore

Ransomware and intrusion crews have repeatedly used exposed VPN and firewall portals as the front door into larger environments.
The lore here is brutal: once the perimeter admin surface is reachable, the attacker no longer needs to guess where the trust boundary lives.

How To Read It

Use this when you want to know whether the traffic is intentionally hunting security-device consoles rather than generic web pages.

Defender Takeaway

Treat this as perimeter pressure. The attacker is not browsing your website; they are looking for the keys to the gate.

Catalog Definition

Flags requests that hit known firewall, VPN, and gateway management or login surfaces such as Fortinet remote-login paths, Palo Alto GlobalProtect portals, Cisco ASA/WebVPN prefixes, F5 TMUI routes, Pulse/Ivanti auth paths, and similar vendor-specific endpoints. It also emits on distinctive firewall/VPN client user agents, while generic keywords like "firewall" or "vpn" only count when combined with other hints such as 401/403 responses. This annotator is meant to surface informed attackers and scanners explicitly probing security-device consoles and portal surfaces, not generic payload injection. Interpret alongside scan velocity, Never-200-like behavior, and credential brute-force signals.

Firewall/VPN Console Probing

What This Annotator Watches

10 Most Recent Real Samples

Confirm Action