nmap service enumeration launched from container or script worker (ARTEX Worker)
Detects execution of the Nmap scanning tool initiated by script interpreters, shells, or container runtimes, coupled with network behavior indicating a fan-out of connections to multiple distinct hosts or ports.
Microsoft Sentinel (KQL)
