Rapid Multi-Target Exploit Chaining Indicative of AI Agent Tooling
Detects a single source IP address rapidly attempting connections to multiple distinct devices and ports within a short time window. This behavior is indicative of an automated agent or scanner performing reconnaissance and potentially attempting to chain exploitation across multiple targets.
Microsoft Sentinel (KQL)
