ET SCAN Multiple FTP Root Login Attempts from Single Source – Possible Brute Force Attempt

This alert is triggered when detecting multiple FTP root login attempts from a single source, suggesting a possible brute force attack. FTP (File Transfer Protocol) is a standard internet protocol used to transfer files between a client and a server over a network. The rule checks for the use of the username "root" in login attempts, which is the superuser account in many systems. This alert may be triggered when an adversary is attempting to gain unauthorized access to the FTP server by trying to brute-force the root account.