Detect Internal Port Scanning
Requires Defender DeviceNetworkEvents table Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers. Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Microsoft Sentinel (KQL)
