Automated Port Scan Sweep via High Distinct Port/Host Count

Ankit Mehta@Secvyn

•updated Sep 30, 2026•1•0•3

Detects a single source IP initiating network connections to 50 or more distinct destination ports within a 60-second window, which is indicative of an automated port scanning sweep. The rule correlates individual connection events while excluding pre-defined allowlisted vulnerability scanners.