synscan_internal_internal

Explanation

The synscan_internal_internal NDM is designed to detect SYN scanning on internal networks. This NDM monitors for excessive SYN packets that can indicate malicious activity and flags any suspicious activity.

What to Look For

When examining the results of synscan_internal_internal, look for an unusually high number of SYN packets and no corresponding ACK packets. This indicates that an attacker may be attempting to perform a SYN flood attack. It is important to investigate the source of these packets, as well as the destination IP address. Any systems generating large numbers of SYN packets should be investigated to identify the potential attacker, while also monitoring network traffic for any further signs of malicious activity.

Related MITRE ATT&CK Categories

Network Service Discovery, Technique T1046 - Enterprise
Active Scanning, Technique T1595 - Enterprise