JDY Botnet-Style Distributed Port Scan Detection from Single Source IP

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects anomalous network scanning behavior originating from internal hosts. The rule triggers when a host contacts a high number of distinct ports (greater than 50) or establishes a large number of connections (greater than 100) to a high number of distinct IP addresses (greater than 20), excluding common internal network segments. This behavior is indicative of network reconnaissance or service discovery activities typical of an adversary mapping the network.