Internal Lateral Movement Scan - Burst SYN to SSH/RDP/SMB Ports

Ankit Mehta@Secvyn

•updated 28 days ago•0•0•3

This rule monitors for a rapid sequence of TCP SYN packets directed towards common administrative ports (SSH/22, RDP/3389, SMB/445) within a short window, indicative of an automated lateral movement scanning attempt or a brute-force discovery phase originating from within the internal network.