Full Privileged Port Range Scan Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a full privileged port range scan. It triggers an alert if a source IP sends 200 TCP SYN packets to ports 0-1024 on the home network within a 10-second window. This behavior is indicative of an attacker attempting to discover open services on well-known ports.