SigmaHQ/rules/network/net_susp_network_scan.yml
2017-04-15 11:32:38 +02:00

18 lines
462 B
YAML

title: Network Scans
description: Detects many failed connection attempts to different ports or hosts
author: Thomas Patzke
logsource:
type: firewall
detection:
selection:
action: denied
timeframe: 24h
condition:
- selection | count(dst_port) > 10 by src_ip
- selection | count(dst_ip) > 10 by src_ip
falsepositives:
- Inventarization systems
- Vulnerability scans
- Penetration testing activity
level: medium