GCP-NET - VPC Flow - Port Scanning and Fan-out Behaviour
This rule monitors GCP VPC Flow logs for unusual network traffic patterns originating from internal private IP address ranges (RFC 1918). It calculates daily distinct destination IP and port counts per source IP, establishing a baseline of normal behavior. It flags anomalies where current traffic ratios for destinations or ports exceed a threshold of 3x compared to the baseline, or identifies 'new host spray' patterns where a source suddenly targets an unusually high number of ports or destinations without prior history, indicating potential reconnaissance or scanning activity.
Sigma
