ATT&CK T1046 - Network Service Scan Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects network service scanning activity by identifying a high volume of TCP SYN packets (flags:S) from a single source IP address to multiple destinations within the HOME_NET over a short period. Specifically, it triggers if 50 or more SYN packets are observed from the same source within 10 seconds. This behavior is indicative of an attacker attempting to discover open ports and services on internal network hosts, a common reconnaissance technique.