Nightspire - Rapid Local Network Subnet Scanning

Ibrahim Saud@tektrix

•updated Jun 22, 2026•3•1•16

This rule detects rapid scanning of local network subnets on SMB (port 445) and RDP (port 3389) by a single process on a device. It identifies instances where a process initiates connections to more than 20 unique local IP addresses within a one-minute window, which could indicate an attempt by ransomware, such as Nightspire, to identify adjacent victims for propagation prior to local encryption.