Network scanning is the universal precursor to lateral movement and exploitation. Attackers map the network topology, identify live hosts, enumerate open services, and fingerprint operating systems before moving to the exploitation phase. Internal scanning from a compromised host is particularly dangerous — it indicates the attacker has already achieved initial access and is actively expanding. SMB sweeps targeting port 445 across the /16 or /24 subnet are the most common lateral movement precursor seen post-initial-compromise. External scans from internet IPs indicate active reconnaissance by an unauthenticated threat actor.
Key data sources: ASimNetworkSession (ASIM-normalized network flow logs), DeviceNetworkEvents (MDE endpoint-level network telemetry), CommonSecurityLog (Palo Alto / Cisco ASA firewall flows), AzureFirewallNetworkRule (Azure Firewall deny logs).
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWNetwork scanning falls into two attack phases: external pre-compromise reconnaissance (T1595 — Active Scanning) where the attacker enumerates perimeter assets, and post-compromise internal discovery (T1046 — Network Service Discovery) where a compromised internal host scans the internal network for pivot targets. Internal scanning is far more dangerous as it operates within trust boundaries and can reach systems protected from external access. Common scan types: SYN scan (half-open, stealthy), connect scan (full TCP, noisy), UDP scan (service enumeration), and OS fingerprinting (TTL/window-size analysis). NMAP is the canonical tool but impacket, masscan, netcat, and PowerShell are all used for scanning in post-exploitation.
| Field | Value |
|---|---|
| MITRE Techniques | T1046 — Network Service Discovery (post-compromise internal) T1595.001 — Active Scanning: Scanning IP Blocks (external pre-compromise) |
| Kill-chain Phase | Reconnaissance / Discovery |
| Primary Log Source | ASimNetworkSession, DeviceNetworkEvents, CommonSecurityLog |
| Secondary Log Sources | AzureFirewallNetworkRule (denied connections), SecurityEvent 5156 (Windows Filtering Platform), Sysmon Event 3 (NetworkConnect) |
| High-Risk Target Ports | 445 (SMB/lateral movement), 3389 (RDP), 5985/5986 (WinRM), 22 (SSH), 23 (Telnet), 80/443 (web), 1433 (MSSQL), 3306 (MySQL), 8080 (web proxy) |
| Default Severity | Internal scan: SEV2 — indicates active compromise. External scan from internet: SEV3 — reconnaissance, monitor and block. |
Internal host scanning port 445 across multiple /24 subnets within your network is one of the most reliable pre-ransomware indicators. WannaCry, NotPetya, and Conti all exhibited subnet-wide SMB scanning within minutes of initial access. Any internal SMB sweep should be treated as a potential ransomware precursor until proven otherwise.
02 — IDENTIFICATION
2 INDICATORSAn internal host connecting to many distinct destination IPs on the same port within a short time window is the definitive signature of a horizontal host sweep — the most common post-compromise discovery technique. SMB sweeps (port 445) are the precursor to EternalBlue exploitation, Mimikatz pass-the-hash, and ransomware deployment. RDP sweeps (port 3389) indicate brute-force credential spraying or search for unpatched BlueKeep (CVE-2019-0708) targets. The threshold of 20+ distinct destination IPs in 5 minutes on the same port from a single workstation is not achievable by normal user activity — it is exclusively scanner behaviour.
- 1Run the horizontal scan KQL query. Focus time range on Last 1 hour for active incidents; Last 24 hours for hunting. Any internal source IP connecting to >20 unique destinations on port 445 in 5 minutes is automatic SEV2.
- 2For each flagged source IP, pivot to DeviceNetworkEvents to identify the initiating process —
nmap,masscan,arp-scan,Invoke-Portscan(PowerShell), or a known malware binary. NMAP generates a distinctive RST flood pattern; masscan connects faster than any human-operable tool. - 3Check the process parent chain — if the scanner process was spawned by
powershell.exewhich was spawned bycmd.exewhich was spawned bywmiprvse.exeormshta.exe, you have confirmed post-exploitation lateral movement, not an authorized scanner. - 4Review the list of successfully connected destinations (not just TCP SYN, but full TCP connect or port open responses) — these are the attacker's discovered targets. Alert on each of those hosts as potential next-pivot candidates.
- 5Cross-reference the scanning source host in MDE Incidents — if there's a preceding alert on the same device within 24 hours (phishing, credential theft, code execution), this is confirmed post-compromise internal reconnaissance.
| Indicator | Meaning | Severity |
|---|---|---|
| >20 unique dest IPs, same port, 5 min | Horizontal host sweep — active post-compromise discovery, attacker mapping live hosts | HIGH |
| Port 445 sweep from workstation | SMB discovery — ransomware/worm propagation precursor or EternalBlue targeting | CRITICAL |
| Port 3389 sweep from internal host | RDP targeting — credential spray or BlueKeep/DejaBlue vulnerability scan | HIGH |
| Sequential /24 subnet IP targeting | Subnet enumeration — attacker systematically mapping the entire subnet range | HIGH |
| NMAP process found on endpoint | Scanning tool binary present — either attacker-deployed tool or insider threat | MEDIUM |
If the sweeping host is a server (not a workstation) — particularly a domain controller, file server, or SQL server — treat as SEV1 immediately. A server performing internal reconnaissance strongly indicates it has been compromised and the attacker is mapping the network for a domain-wide attack.
External scanning from internet IPs targets your perimeter — public-facing IPs, load balancers, VPN concentrators, and exposed services. Vertical scans test many ports against a single target to enumerate all open services (e.g., NMAP service version scan against your firewall IP). These are reconnaissance for exploitation and often precede exploitation attempts by hours to days. Firewall deny logs showing a single external IP generating SYN packets against 20+ ports on your public IP within minutes are the clearest external scan signature. Also watch for Shodan/Censys/ZoomEye scanner ASNs — they perform legitimate internet mapping but their scans validate your attack surface exposure.
- 1Run the vertical scan query against
AzureFirewallNetworkRuleorCommonSecurityLog. Filter for denied connections from single external IPs targeting many distinct destination ports on the same internal/public IP. - 2For each scanning source IP, check via threat intelligence — navigate to Sentinel → Threat Intelligence and query the IP. Also check via passive DNS to determine if the IP is a known scanner (Shodan:216.239.32.0/19, Censys:167.248.133.0/24) or a malicious scanning node.
- 3Look for successful connections after the scan (connection = allowed by firewall) — these are the services the attacker has confirmed as open. Pivot to those destination IPs and check for follow-on exploitation attempts in the next 24–48 hours.
- 4If scanning originates from a previously unseen ASN and focuses on high-value ports (22, 443, 3389, 8443, 8080), create a watchlist entry and monitor for exploitation attempts from the same /24 subnet over the next 7 days.
| Indicator | Meaning | Severity |
|---|---|---|
| >10 unique ports, single external IP, 5 min | Vertical port scan — attacker enumerating services on your public IP | MEDIUM |
| SYN packets with no ACK (half-open scan) | NMAP SYN stealth scan — attacker using half-open technique to avoid IDS connection logging | MEDIUM |
| Scan from known scanner ASN (Shodan/Censys) | Legitimate internet mapping — still validates attack surface; check what was found open | LOW |
| Scan followed by exploitation attempt <1hr | Active targeted attack — scan was pre-exploitation discovery; immediately escalate | HIGH |
03 — CONTAINMENT
DECISION + ACTIONS- 1Authorized scanner whitelist check: Before any containment action, verify if the source IP is in your authorized scanning IP list (Nessus, Qualys, Rapid7 InsightVM, Tenable.sc). Isolating an authorized scanner causes unnecessary disruption.
- 2External IP block: For external scanners, add source IP/CIDR to firewall deny list. For targeted scans (not Shodan/Censys), also block at upstream ISP level if volume is significant.
- 3Notify scanned host owners: Alert the owners of hosts that were successfully reached during the internal scan — they need to verify no exploitation occurred against their exposed services.
04 — ERADICATION
CLEANUP & RECOVERY- 1Remove scanning tool from compromised host: Use MDE Live Response to locate and delete the scanning binary. Check
%TEMP%,%APPDATA%, and any recently created directories. Run a full AV scan viarun antimalware-scan.exe /full. - 2Audit successfully reached hosts: For every destination IP that responded to the scan (open port), review logs on that host for the 24 hours following the scan. Look for authentication attempts, new processes, or lateral movement from the scanning source IP.
- 3Network segmentation review: An internal host reaching 20+ IPs on port 445 indicates insufficient network segmentation. Workstations should not have direct SMB access to servers. Implement micro-segmentation or VLAN isolation to prevent host-to-host SMB where not required.
- 4Disable unnecessary exposed services: For any service found open by external scan that has no legitimate external access requirement, block at firewall. Disable or restrict: open RDP to internet, Telnet, SNMP public community string, SMB exposed externally.
05 — ESCALATION
THRESHOLDS & CONTACTS| Condition | Action | Severity |
|---|---|---|
| Internal SMB sweep from workstation/server | Escalate to SOC Lead — confirmed post-compromise; treat as ransomware precursor until ruled out | SEV2 |
| Internal scan + prior compromise alert on same host | Escalate to CISO — confirmed attack in progress; initiate full IR playbook; scan scope maps attacker's lateral movement intent | SEV1 |
| Server (DC, file server, DB) scanning internally | Escalate to SOC Lead + CISO immediately — high-value asset compromise; critical infrastructure at risk | SEV1 |
| External scan from non-scanner ASN | Add to watchlist, monitor for follow-on exploitation; no escalation needed unless exploitation observed | SEV3 |
| External scan followed by exploitation attempt | Escalate immediately — active targeted attack; invoke full IR playbook for affected host | SEV1/SEV2 |
CyberHawk Threat Intel
Built by Rudra Verma | Senior Cyber Security Architect & Researcher
"They can't exploit you if you are the Exploit."
Authorized security research & penetration testing only. Unauthorized use is illegal.