Zscaler Private Access Port Probing Behaviour
Detects clients reaching for ports that are unreachable or not permitted. A client repeatedly attempting wrong ports against brokered applications is enumerating what the broker will allow, which is reconnaissance conducted entirely inside an authenticated zero trust session. Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=zpa-connector where sourcename='ZSCALER-SPA' and action in ('CLIENT_WRONG_PORT', 'PORT_UNREACHABLE') | duration 1h | groupby user, srcip | select user, srcip, distinct_count(dstport) | having distinct_count_col1 > 10
Sigma
