Elastic medium stable kql

Potential Network Scan Executed From Host

This threshold rule monitors for the rapid execution of unix utilities that are capable of conducting network scans. Adversaries may leverage built-in tools such as ping, netcat or socat to execute ping sweeps across the network while attempting to evade detection or due to the lack of network mapping tools available on the compromised host.

View Source

Detection Logic

event.category:process and host.os.type:linux and event.type:start and
event.action:(exec or exec_event or executed or process_started or start or ProcessRollup2) and
process.name:(ping or nping or hping or hping2 or hping3 or nc or ncat or netcat or socat)

Field Validations

Loading…

Comments (0)

Loading comments...