Remote System Discovery `T0846`

ICS Tactic: Discovery

Authoring guide

These 1 rule share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeviceProduct`	1	`eq` 1	`isid`
`EventClassID`	1	`in` 1	`105`, `150`, `151`
`EventMessage`	1	`contains` 1	`scan`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeviceProduct`	`eq`	`isid` kustoRadiflow - Network Scanning Detected	1	8
`EventClassID`	`in`	`105` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`150` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`151` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`152` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`153` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`158` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`166` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`175` kustoRadiflow - Network Scanning Detected	1
`EventClassID`	`in`	`52` kustoRadiflow - Network Scanning Detected	1
`EventMessage`	`contains`	`scan` kustoRadiflow - Network Scanning Detected	1

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application