Potential Port Scan - Single Host Hitting Many Ports/Hosts
This rule detects potential port scanning activity from a single host. It identifies scenarios where a device attempts to connect to a large number of unique remote ports (20 or more) or a large number of unique remote IP addresses (25 or more) within a 10-minute window. This behavior is indicative of an adversary attempting to discover open ports or active hosts on a network.
Microsoft Sentinel (KQL)
