Potential external port scan via system ports
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Port scan by an external entity over network traffic may be indicative of a malicious entity attempting to uncover vulnerable endpoints in order to gain access into a network.
Severity
Attention
Rule Requirement
Criteria
possible_external_port_scan_over_system_ports_e1: logtype = "*" and IENAME = "Traffic Allowed" | groupby SOURCE_IP limit 25 | groupby DEST_IP with dcount(DEST_PORT) limit 25 having dcount(DEST_PORT) > 10 select possible_external_port_scan_over_system_ports_e1.DEST_IP as DestinationIP, dcount(possible_external_port_scan_over_system_ports_e1.DEST_IP.DEST_PORT), possible_external_port_scan_over_system_ports_e1.SOURCE_IP as SourceIP
Detection
Execution Mode
scheduled
Log Sources
Network
