Ravi Sir's Cyber Security Cards › Revision Cards
Detection – Outbound IoT, Failed Logins, Protocol Oddities
Detection – Outbound IoT, Failed Logins, Protocol Oddities How a defender spots a hacked IoT device from its network behaviour. A camera or sensor suddenly talks to random internet IPs (a sign of command-and-control ). MQTT message storms. A burst of failed logins on a camera. IoT devices have a fix
Read card text
What this card says
What it is
How a defender spots a hacked IoT device from its network behaviour.
Warning signs
A camera or sensor suddenly talks to random internet IPs (a sign of command-and-control).
MQTT message storms. A burst of failed logins on a camera.
Why it matters for security
IoT devices have a fixed job, so odd traffic stands out.
Watch the IoT network and alert on anything new.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| Infected cam scans LAN + phones home | Egress deny/allow-list; Suricata on IoT span; SIEM rare-dest |
| Brute camera UI from Kali (lab) | Log + lockout; alert on .10 → .50:80 bursts in lab |
| Idle Modbus recon from IT laptop | Firewall deny + alert; ticketing for any OT allow |
Learn more in the lesson: 43.8 Detection – Outbound IoT, Failed Logins, Protocol Oddities