Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Port scan detected (ASIM Network Session schema)

This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port…

Description

This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema

Detection logic

Detection requirements

Platform
ContainersIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
aivectrastreamawss3azurefirewallazuremonitor_vminsightsazurensgcheckpointciscoasaciscoasaamaciscomerakicorelightfortinetmicrosoftsysmonforlinuxmicrosoftthreatprotectionpaloaltonetworkssecurityeventswindowsforwardedeventswindowssecurityeventszscaler
Log source service
awsvpcflowazurediagnosticsciscomerakinativepollercommonsecuritylogcorelight_cldevicenetworkeventssecurityeventsyslogvectrastreamvmconnectionwindowsevent

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice