SOP-33: Network Scan and Port Sweep Response

Rudra Verma, Senior Security Architect & Researcher · 2026-08-15

Network scanning is a critical post-exploitation phase where attackers enumerate live hosts, open ports, and running services to identify lateral movement targets. Tools like nmap, masscan, CrackMapExec, and Cobalt Strike's port scanner generate highly recognizable connection patterns in network flow logs.

This SOP covers two detection paths: vertical scanning (one source hitting many ports on one target) and horizontal sweeping (one source hitting the same port across many hosts), both detectable via ASimNetworkSession in Microsoft Sentinel.

☰ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation

🛠

01 — BACKGROUND

TECHNIQUE OVERVIEW

Network Scan & Port Sweep Techniques

T1046 / T1595.001

Network scanning occurs in two main forms: vertical scans where a single source probes many ports on one or few hosts (service enumeration), and horizontal sweeps where a single source probes the same port across many hosts (host discovery). Both are detectable by the abnormal fan-out ratio in network flow data. Attackers particularly target ports 445 (SMB), 3389 (RDP), 22 (SSH), 5985/5986 (WinRM), and 1433 (MSSQL) for lateral movement preparation.

Field	Value
MITRE Technique	T1046 — Network Service Discovery
Sub-technique	T1595.001 — Active Scanning: Scanning IP Blocks
Log Sources	ASimNetworkSession, CommonSecurityLog, DeviceNetworkEvents, AzureNetworkAnalytics_CL
Key Indicators	>100 unique destination ports from single source (vertical), same port to >30 hosts (horizontal), high RST/SYN ratio
High-Value Ports	445 (SMB), 3389 (RDP), 22 (SSH), 5985/5986 (WinRM), 1433 (MSSQL), 5432 (PostgreSQL)
Detection Priority	HIGH — scanning precedes lateral movement and ransomware deployment

Vulnerability scanners (Nessus, Qualys, Rapid7) and IT asset management tools produce scan-like patterns. Always check if the source IP belongs to an authorized scanner before escalating.

🔍

02 — IDENTIFICATION

2 INDICATORS

▶ Investigation Workflow

Vertical Port Scan Detection

T1046

WHY CHECK

A single host probing hundreds of ports on internal targets in a short window is the definitive signature of a port scanner — no legitimate application generates this connection fan-out pattern.

📍 Portal Navigation — Microsoft Sentinel

portal.azure.com› Microsoft Sentinel› Logs

1Open Sentinel workspace → click Logs.
2Confirm ASimNetworkSession table is populated — requires Network Session ASIM parser enabled under Settings → Workspace Settings.
3Paste the KQL below; set time range to Last 1 hour.
4Review UniqueDestPorts per SrcIpAddr — values above 100 ports in 10 minutes confirm scanning activity.
5Check if SrcIpAddr is in the authorized scanner whitelist (Nessus, Qualys, SCCM). If not, proceed to Containment.

Field / Value	Meaning	Action
UniqueDestPorts > 100	Single source hitting over 100 distinct ports — nmap/masscan signature	ESCALATE
NetworkProtocol = TCP + SYN-only	SYN scan without completing handshake (stealth scan) — tool-generated	ESCALATE
DstPortNumber in 445,3389,22	Lateral movement ports targeted — attacker is mapping accessible services	INVESTIGATE

DETECTS: Single source IP generating connections to more than 100 unique destination ports within a 10-minute window — classic nmap/masscan vertical scan signature.

KQL — Microsoft Sentinel (ASimNetworkSession)

ASimNetworkSession | where TimeGenerated > ago(1h) | where ipv4_is_private(SrcIpAddr) | summarize UniqueDestPorts = dcount(DstPortNumber), UniqueDestHosts = dcount(DstIpAddr), TotalConnections = count(), TargetedPorts = make_set(DstPortNumber, 20) by SrcIpAddr, bin(TimeGenerated, 10m) | where UniqueDestPorts > 100 or UniqueDestHosts > 30 | order by UniqueDestPorts desc

DETECTS: Same vertical port scan pattern in Splunk network flow data — high unique destination port count from a single internal source.

SPL — Splunk

index=* sourcetype=network (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) | bucket _time span=10m | stats dc(dest_port) as unique_dest_ports, dc(dest_ip) as unique_dest_hosts, count as total_conns, values(dest_port) as targeted_ports by src_ip _time | where unique_dest_ports > 100 OR unique_dest_hosts > 30 | sort -unique_dest_ports

Exclude known scanner IPs from your network management VLAN before alerting. A query returning only scanners is noise, not signal — tune the exclusion list in a custom watchlist in Sentinel.

Horizontal SMB / RDP Sweep

T1595.001

WHY CHECK

Attackers sweep SMB port 445 and RDP port 3389 across all reachable subnets to find exploitable or credential-stuffable targets — the horizontal sweep pattern has a unique one-port-to-many-hosts signature.

📍 Portal Navigation — Defender XDR Advanced Hunting

security.microsoft.com› Hunting› Advanced Hunting

1Navigate to security.microsoft.com → Hunting → Advanced Hunting.
2Paste the KQL below to identify hosts sweeping lateral movement ports across the network.
3Review UniqueTargets — more than 30 unique hosts swept on port 445 or 3389 in 5 minutes confirms active reconnaissance.
4Check InitiatingProcessFileName — cmd.exe, powershell.exe, or unknown executables initiating scans are high-confidence compromised hosts.
5Pivot to Device Timeline for the scanning host to see what process started the sweep and trace it back to the initial access vector.

DETECTS: A single internal host connecting to port 445 or 3389 on more than 30 distinct targets within 5 minutes — the horizontal sweep pattern used before Pass-the-Hash and RDP brute force attacks.

KQL — Defender XDR Advanced Hunting

DeviceNetworkEvents | where Timestamp > ago(1h) | where RemotePort in (445, 3389, 22, 5985, 5986, 1433) | where ActionType == "ConnectionAttempt" | summarize UniqueTargets = dcount(RemoteIP), TargetPorts = make_set(RemotePort), ScanCount = count() by DeviceName, InitiatingProcessFileName, RemotePort, bin(Timestamp, 5m) | where UniqueTargets > 30 | order by UniqueTargets desc

DETECTS: Horizontal SMB/RDP sweep pattern in Splunk — one source, one port, many destination hosts within a 5-minute window.

SPL — Splunk

index=* sourcetype=stream:tcp dest_port IN (445, 3389, 22, 5985, 5986) | bucket _time span=5m | stats dc(dest_ip) as unique_targets, count as scan_count by src_ip dest_port _time | where unique_targets > 30 | sort -unique_targets

Correlate scan source IP against recent authentication failures in SecurityEvent (Event ID 4625) — a host that is both scanning SMB and generating failed auth events is actively attempting lateral movement via credential stuffing.

🚫

03 — CONTAINMENT

IMMEDIATE ACTION

Verdict & Escalation Decision

DECISION GATE

▶ Triage Verdict — Select One

CONFIRMED Unauthorized source, >100 ports or >30 hosts, lateral movement ports targeted → Isolate scanning host, block outbound on firewall, escalate to L2

PARTIAL Moderate fan-out, unknown source, not yet confirmed malicious → Enable enhanced netflow logging, investigate process on source host, 30-min re-check

FALSE POSITIVE Authorized scanner (Nessus, Qualys, SCCM), scheduled scan time → Whitelist source IP in detection rule, document, close ticket

Do not block the scanning host at the network layer without isolating it first via Defender for Endpoint. A network block alone leaves the host running the implant while cutting off your visibility.

Isolate Scanning Host

CONTAINMENT

📍 Portal Navigation — Defender for Endpoint Device Isolation

security.microsoft.com› Assets› Devices› [Device] → Isolate

1Go to security.microsoft.com → Assets → Devices → search for the scanning host by IP or hostname.
2Click the device → Actions → Isolate device → confirm. This cuts all network access while preserving Sentinel telemetry.
3Open Device Timeline → review processes spawned 30 minutes before the scan started — identify the initial access vector.
4Add NSG rule to block all outbound from the source IP at the Azure layer as a secondary control.
5Open an IR ticket, assign to L2, and include: source IP, scan type (vertical/horizontal), targeted ports, first-seen timestamp, and process name.

🗑

04 — ERADICATION

CLEANUP

Remove Scanner Tool & Remediate Host

ERADICATION

1Run a full Defender AV scan on the isolated host to identify and quarantine any malicious scanner binaries.
2Review InitiatingProcessFileName — if the scanner was powershell.exe or cmd.exe, extract the full command line from the Device Timeline.
3Check for LOLBin usage: net view, arp -a, ping sweep, Test-NetConnection — document the full recon chain.
4Verify no new local accounts were created on the host during the scan window (SecurityEvent 4720).
5Add the scanner binary hash to Defender for Endpoint custom indicators → Block and remediate.
6Re-image the host if the implant is confirmed — do not simply remove the scanner binary without addressing the underlying compromise.

Eradication Complete When

No ASimNetworkSession scan events from affected host in past 30 minutes
Scanner process terminated and binary quarantined or removed
No new local accounts created during compromise window
NSG outbound block rule confirmed active
Device isolation released only after IR lead approval

📢

05 — ESCALATION

ESCALATION PATHS

ES1

Escalation Matrix

ESCALATION

Condition	Severity	Action	Notify
Unauthorized host scanning lateral movement ports	SEV2	Isolate host, open IR, investigate compromise	SOC Lead → IR Team
Scan followed by successful SMB/RDP auth	SEV1	Full IR, lateral movement containment	SOC Lead → CISO
Domain controller is the scan source	SEV1	Immediate IR, assume domain compromise	SOC Lead → CISO → All stakeholders
Moderate fan-out, unknown source	SEV3	Enhanced monitoring, 4-hour investigation window	SOC Lead (async)
Confirmed authorized scanner	INFO	Whitelist IP, tune rule, close ticket	None

If the scanning host is a server or service account host rather than a workstation, treat as SEV1 by default — servers do not run portscans legitimately, and the blast radius of a compromised server is significantly higher.

Stay Threat-Ready

Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.

📺 YouTube 🎤 TikTok 🐦 X / Twitter 📡 Telegram

All SOPs Blog Web App (Free)

They can't exploit you if you are the Exploit.