How do you detect VPN or edge device exploitation?

Monitor the appliance and the sessions it creates. Compare each VPN logon to the user's history and to hosting-provider ranges, flag logons with missing or anomalous MFA, and alert on a first-seen source followed by scanning or SMB fan-out from the assigned VPN address. Forward the appliance's administrative audit log and alert on new admins, new users or disabled logging. After any relevant advisory, assume exploitation may precede patching: patch, rotate secrets stored on the device and hunt back through logons.

Detecting VPN and Edge Device Exploitation as Ransomware Entry

Edge appliances such as VPN gateways and firewalls are attractive: internet-facing, privileged, and often weakly monitored. After exploitation, operators log in as legitimate users or create their own, then scan inward. Because the device itself rarely runs endpoint detection, you rely on its logs, configuration state and the behaviour of the addresses it hands out.

Signals at a Glance

Signal	Where	ATT&CK
VPN logon from a rare ASN, country or hosting provider	VPN logs	T1133
Logon with no MFA event or a bypass-pattern session	VPN and IdP logs	T1078
New local admin or configuration change on the appliance	Appliance audit log	T1190
Same account on two sessions from different locations	VPN logs	T1078
Scanning or SMB fan-out from the VPN address pool	Firewall, Zeek	T1046

Anomalous VPN Logons

Compare every VPN session with the user’s own history and with a hosting-provider list. The signal is stronger when a logon is the first appearance of a source and is followed by immediate internal activity:

// Sentinel (KQL) - rare-source VPN logon followed by internal discovery
let known = VpnLogs
| where TimeGenerated between (ago(30d) .. ago(1d))
| summarize by UserName, SourceAsn;
VpnLogs
| where TimeGenerated > ago(1d) and Result == "Success"
| join kind=leftanti known on UserName, SourceAsn
| join kind=inner (
    CommonSecurityLog
    | where TimeGenerated > ago(1d)
    | summarize dests=dcount(DestinationIP), ports=dcount(DestinationPort) by SourceIP
    | where dests >= 25
  ) on $left.AssignedIp == $right.SourceIP
| project TimeGenerated, UserName, SourceIp, SourceAsn, AssignedIp, dests, ports
// tune/validate: table and field names vary by vendor connector

The Appliance Itself

Treat the device as a monitored asset. Forward its administrative audit log and watch for changes no one requested:

Alert on new administrator accounts, new VPN user objects, changed authentication servers and disabled logging on the appliance.
Compare configuration and file integrity against a known-good snapshot after any vendor advisory affecting your model.
Review web access logs on the management and portal interfaces for unusual requests, then pivot to logons from the same source.
When an advisory applies, assume exploitation may have preceded patching: patch, rotate credentials and secrets stored on the device, then hunt back through logons.

Vetted sources

Vendor advisories and integrity-check tooling for your specific appliance, CISA #StopRansomware guidance on edge devices, SigmaHQ and Elastic VPN anomaly content, and Splunk ESCU authentication analytics. Baseline your own VPN populations, including travel and contractor access.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Anomalous VPN Logons

The Appliance Itself

Build Detections That Fire

Ransomware Precursor Detection

Detection Hub

Initial Access Broker Detection

RDP Brute Force Detection