JDY Botnet High-Rate Port Scan from SOHO IP Ranges
Detects high-frequency port scanning activity from external, non-private IP addresses targeting common network services. The rule identifies different scanning profiles, including wide port sweeps and targeted multi-port scans, which are consistent with reconnaissance behaviors observed in botnet activity like the KV/JDY clusters.
Microsoft Sentinel (KQL)
