connscan_external_internal

Explanation

The connscan_external_internal NDM detects connection scanning attempts hitting the customer's network from the Internet. It does this by monitoring for a high rate of aborted successful TCP connections, which may indicate an attacker attempting to discover available services or potential vulnerabilities on the network edge. The NDM triggers when it detects a threshold of connections to different services within a certain time period.

What to Look For

Scanning activity on the Internet is quite commonplace. If there are unexpected services exposed to the Internet, check firewall or other blocking rules to prevent unwanted exposure.

Related MITRE ATT&CK Categories

Reconnaissance: Active Scanning, Technique T1595 - Enterprise