Detection of Internal Horizontal Port Scanning Activity

This brief outlines a behavioral detection analytic designed to identify internal horizontal port scanning, a common precursor to lateral movement and network exploitation. The detection triggers when an internal host attempts to initiate connections to 250 or more unique destination IP addresses within a one-hour window, specifically targeting ports frequently probed by the NMAP tool (e.g., 21, 22, 23, 25, 53, 80, 443, 3389, 445, 3306).

This activity is characteristic of network discovery and reconnaissance performed by threat actors or automated worms to map internal network segments, identify accessible services, and locate potential targets for further compromise. Because this detection monitors network telemetry from infrastructure such as VPC flow logs and firewall connection events, it provides visibility into malicious movement that might otherwise bypass endpoint-based security controls. Defenders should use this analytic to flag unauthorized scanning within the internal network segment.

Impact

Successful internal reconnaissance allows attackers to map internal topology, identify vulnerable services (e.g., SMB/RDP), and stage lateral movement. Unauthorized scanning can lead to data exfiltration, service disruption, and eventual compromise of business-critical assets. Detecting this activity early is essential to interrupting the attack lifecycle before an actor gains persistence or access to sensitive data stores.

Recommendation

• Deploy the provided Sigma rule to your SIEM/Detection platform to monitor network traffic for high-volume, horizontal port scanning behavior.
• Integrate telemetry from network infrastructure (Cisco Secure Firewall, AWS VPC Flow Logs) into the organization's SIEM to populate the Network_Traffic data model required for this detection.
• Investigate any triggered alerts immediately to determine if the source IP is a legitimate administrative scanner, a misconfigured automation, or a compromised asset performing unauthorized reconnaissance.
• Review network access control lists (ACLs) and firewall policies to restrict unnecessary inter-zone communication, especially for sensitive internal segments.