ATT&CK T1046 - UDP Port Scan Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects a UDP port scan by identifying a high volume of UDP traffic from a single source IP address to various ports on the home network within a short time frame. Specifically, it triggers an alert if more than 50 UDP packets are observed from the same source within a 10-second window, indicating a potential network reconnaissance activity.