Network Port Scanning Detection
Detects potential internal network scanning activity by identifying devices attempting connections to 5 or more distinct sensitive ports within a one-hour window. This behavior is indicative of reconnaissance activities aimed at identifying vulnerable services such as SSH, SMB, RDP, or various database management systems.
Microsoft Sentinel (KQL)
