JDY Botnet: SOHO/IoT Device Outbound Port Scanning Indicative of Botnet Reconnaissance
Detects anomalous high-rate outbound network scanning activity (targeting numerous distinct destination IPs and ports) originating from internal SOHO or edge devices (e.g., Cisco, Ubiquiti, Draytek hardware). This pattern is consistent with compromised devices acting as nodes within a botnet, such as the JDY cluster, conducting reconnaissance.
Microsoft Sentinel (KQL)
