AI Agent Rapid Local Scanning (T1046)
Correlates an AI/LLM process executing high-volume network scanning against the internal subnet. This rule detects when processes named 'python.exe' or 'node.exe' initiate a high volume of network connections (more than 20 unique IPs within a minute) to internal IP ranges (10.0.0.0/8 or 192.168.0.0/16).
Microsoft Sentinel (KQL)
