ATT&CK T1595.001 - Active IP Block Scan Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects an active IP block scan by monitoring TCP SYN packets. It triggers an alert if more than 100 SYN packets are observed from a single source IP address within a 10-second window, indicating a potential reconnaissance activity where an attacker is scanning a range of IP addresses to identify live hosts or open ports.