Mass External Scanning Targeting Internet-Facing FortiGate/FortiClient EMS Hosts

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•3

This rule monitors network traffic to detect potential scanning activity by identifying single remote IP addresses communicating with more than 50 distinct internal hostnames within the observed timeframe. This behavior is often indicative of automated reconnaissance, such as vulnerability scanning or network discovery, performed by an adversary attempting to map the environment.