Potential Network Sweep Detected
This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2023/05/17"
3integration = ["endpoint", "network_traffic"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2024/01/05"
8
9[rule]
10author = ["Elastic"]
11description = '''
12This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target
13network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and
14weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized
15access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts
16from one source host to 10 or more destination hosts on commonly used network services.
17'''
18from = "now-9m"
19index = ["packetbeat-*", "auditbeat-*", "filebeat-*", "logs-network_traffic.*", "logs-endpoint.events.network-*",]
20language = "kuery"
21license = "Elastic License v2"
22max_signals = 5
23name = "Potential Network Sweep Detected"
24risk_score = 21
25rule_id = "781f8746-2180-4691-890c-4c96d11ca91d"
26severity = "low"
27tags = ["Domain: Network",
28 "Tactic: Discovery",
29 "Tactic: Reconnaissance",
30 "Use Case: Network Security Monitoring"
31 ]
32type = "threshold"
33timestamp_override = "event.ingested"
34
35query = '''
36destination.port : (21 or 22 or 23 or 25 or 139 or 445 or 3389 or 5985 or 5986) and
37source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
38'''
39
40[[rule.threat]]
41framework = "MITRE ATT&CK"
42
43[[rule.threat.technique]]
44id = "T1046"
45name = "Network Service Discovery"
46reference = "https://attack.mitre.org/techniques/T1046/"
47
48[rule.threat.tactic]
49id = "TA0007"
50name = "Discovery"
51reference = "https://attack.mitre.org/tactics/TA0007/"
52
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1595"
57name = "Active Scanning"
58reference = "https://attack.mitre.org/techniques/T1595/"
59
60[[rule.threat.technique.subtechnique]]
61id = "T1595.001"
62name = "Scanning IP Blocks"
63reference = "https://attack.mitre.org/techniques/T1595/001/"
64
65[rule.threat.tactic]
66id = "TA0043"
67name = "Reconnaissance"
68reference = "https://attack.mitre.org/tactics/TA0043/"
69
70[rule.threshold]
71field = ["source.ip"]
72value = 1
73[[rule.threshold.cardinality]]
74
75field = "destination.ip"
76value = 100
Related rules
- Potential Network Scan Detected
- Potential SYN-Based Network Scan Detected
- Suspicious Network Tool Launched Inside A Container
- Unusual Discovery Signal Alert with Unusual Process Executable
- Attempt to Deactivate an Okta Network Zone