Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Port scan detected (ASIM Network Session schema)

This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema

ATT&CK coverage

Outside the enterprise matrix

T1046Network Service Discovery 84 detections cover this technique

What the source says

References

https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Sophos%20XG%20Firewall/Analytic%20Rules/PortScanDetected.yaml

Tagged by the source as

Discovery

Detection catalogue

Port scan detected (ASIM Network Session schema)

ATT&CK coverage

Detection requirements

What the source says

References

Tagged by the source as

Detection logic

Port scan detected (ASIM Network Session schema)

ATT&CK coverage

Detection requirements

What the source says

References

Tagged by the source as

Detection logic