Port Scanning Detection

[56kModem]

Has anyone been able to create a custom detection rule that will alert on an internal port scan? Not interested in external port scans on the perimeter firewall - just internal.

The Rapid7 Network Sensor is installed and working. Network Flow logs are being populated. We just haven’t figured out a way to detect a potential malicious device on our network performing a port scan.

Thanks

[darragh_delaney2 (Darragh Delaney)]

Hi 56kModem,
Sensors do not come with port scan detections, we have found that approach is very noisy (false positives) when traffic is used as a data source. Just so I understand correctly, what type of port scan detection are you looking for.

1. An alert when a device on a network is scanning for multiple hosts on a single port number, say TCP 445
2. An alert when a device on a network is scanning a single host on multiple port numbers. In this case it may be trying to find out what ports are open

Darragh

[56kModem]

Hi Darragh,

Thanks for the reply.

#2 looks like what we are trying to accomplish.

[david_smith]

In order to achieve this you would build a Custom Detection Rule, select the Network flow logs and perform a query such as this

where(source_address!=192.10.0.1)groupby(source_address)calculate(unique:destination_port)timeslice(10m)

If you set your time range to last 6 hours at least you can get a sense of what is “normal” in terms of unique destination ports per source address. You could also use source_asset but this may be unattributed and show as unknown.

Then you might need to either exclude certain assets or ports to reduce the noise.

Once your happy with the query you can click on the three dots next to the Run button in Log Search and hit Create Custom Detection Rule

From the new page it will have most of the necessary elements filled out, including your log selection, any query you entered and your groupby and unique counts

The most important piece is not filled out however, and that is the rule threshold logic. See here

In this example, the alert would fire if any source_address was observed in the Network flow logs with 101 unique destination ports in 10 minutes.

I hope this helps you build what you are looking for.

David

[marten_cureton]

I have done this before for port connections to external, i.e. Public IPs but you could very easily flip this to target only internal (Private IPs)

where(destination_address!=/.(127.0.0.|10.|172.1[6-9].|172.2[0-9].|172.3[0-1].|192.168.|192.0.)./ AND destination_port=/80|8080|4433/ AND direction=OUTBOUND)

[56kModem]

Thank you both, David and Marten.

That looks like what we are after. I appreciate all the help!