synscan_internal_external
Explanation
The synscan_internal_external NDM detects SYN scanning activity exiting the network. This event is triggered when an internal IP is found to be scanning external IPs via multiple SYN packets.
What to Look For
To properly examine the results of the synscan_internal_external NDM, you should check for activity on both the network and endpoint. On the network, look for a large number of SYN packets being sent from a single external IP address to multiple internal IPs. On the endpoint, look for any unusual activity or processes running that could be related to the scanning activity. You should take immediate action to remediate any detected scanning activity to prevent potential network vulnerabilities.
Related MITRE ATT&CK Categories
Last updated