External Recon: High Distinct Port/Host or URI Scan (T1595)

Arnold Chan@slaz

•updated Sep 7, 2026•1•0•2

This rule monitors for active reconnaissance or scanning behavior by detecting a single source IP interacting with a high number of distinct ports/hosts within a short time frame (NetworkScan) or accessing a high number of distinct URI paths/404 errors (WebContentScan).