synscan_internal_internal
Explanation
The synscan_internal_internal NDM is designed to detect SYN scanning on internal networks. This NDM monitors for excessive SYN packets that can indicate malicious activity and flags any suspicious activity.
What to Look For
When examining the results of synscan_internal_internal, look for an unusually high number of SYN packets and no corresponding ACK packets. This indicates that an attacker may be attempting to perform a SYN flood attack. It is important to investigate the source of these packets, as well as the destination IP address. Any systems generating large numbers of SYN packets should be investigated to identify the potential attacker, while also monitoring network traffic for any further signs of malicious activity.
Related MITRE ATT&CK Categories
Updated 20 days ago