Hunting Rule: Linux Internal Network Scan via Nmap (T1046)

Danny Y@zendannyy

•updated Jun 24, 2026•1•0•5

Hunting rule for nmap used for internal network discovery. Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with tunneling (chisel, proxychains), or lateral movement. Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped -sT/-Pn scans, and full-port sweeps across private ranges.