Network Port Scanning via nmap, masscan, or PowerShell (T1046)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.