Claude Code agentic process invocation followed by rapid sequential network scanning

Duo Tech@duotech

•updated Jul 15, 2026•13•0•15

Detects instances where the 'claude' or 'claude-code' process initiates network connections to more than 20 distinct destination IP addresses within a short 5-minute window. This behavior is indicative of a tool performing automated network scanning or discovery activities.