Connections from a single IP to an abnormal number of external hosts on uncommon ports
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Abnormal communications from a single internal entity to numerous external hosts on uncommon ports.
Severity
Attention
Rule Requirement
Criteria
single_ip_external_connections_rare_ports_e1: logtype = "*" and IENAME = "Traffic Allowed" and DEST_PORT notin (80, 443, 25, 110, 465, 587, 993, 995,9443, 3356, 8888, 3355, 9090, 10008, 8400, 53, 22, 143, 123) | groupby SOURCE_IP having dcount(DEST_IP) >= 100 | first 1 time select single_ip_external_connections_rare_ports_e1.SOURCE_IP, single_ip_external_connections_rare_ports_e1.SOURCE_IP.TIME, dcount(single_ip_external_connections_rare_ports_e1.SOURCE_IP.DEST_IP)
Detection
Execution Mode
scheduled
Log Sources
Network
