Internal network/service discovery scanning from compromised host
Detects an internal host performing network scanning against multiple internal IP addresses or multiple ports, which is indicative of lateral movement, reconnaissance, or automated worm-like activity within the local network.
Cortex XDR
