UNC6692 - Internal Recon Network Port Scanning (T1046)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•4

Tracks python executing loop structures scanning internal class C subnets on standard lateral movement ports (135, 445, 3389). The rule identifies devices where python.exe initiates network connections to more than 15 unique remote IPs on these ports within a one-minute interval.