Potential external host enumeration via system ports
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Host enumeration by an external entity over network traffic may be indicative of a malicious entity attempting to uncover vulnerable endpoints in order to gain access into a network.
Severity
Attention
Rule Requirement
Criteria
possible_external_host_enumeration_over_system_ports_e1: DEST_PORT in (21,139, 445,53,25, 587,80,443,636, 389,993,995,110,143) | groupby SOURCE_IP with dcount(DEST_IP) having dcount(DEST_IP) > 20 select possible_external_host_enumeration_over_system_ports_e1.SOURCE_IP as Source_IP, dcount(possible_external_host_enumeration_over_system_ports_e1.SOURCE_IP.DEST_IP) as DST_IP_COUNT
Detection
Execution Mode
scheduled
Log Sources
Network
