detection.wiki

Detection rules › Panther

VPC Flow Port Scanning

Source
github.com/panther-labs/panther-analysis

Instances of a srcAddr communicating with multiple ports on a dstAddr could indicate port scanning activity.

Rule body yaml

AnalysisType: scheduled_query
Description: Instances of a srcAddr communicating with multiple ports on a dstAddr could indicate port scanning activity.
Enabled: false
Query: |
  SELECT
    srcAddr,
    dstAddr,
    COUNT(DISTINCT dstPort) as distinctDstPorts,
    vpcId,
    region,
    subNetId
  FROM panther_logs.public.aws_vpcflow
  WHERE p_occurs_since('1 hour')
    and srcAddr != 'null'
    and srcPort not in (443, 80, 2049, 123, 445, 53, 853)
    and dstPort not in (443, 80, 2049, 123, 445, 53, 853)
    and flowDirection = 'egress'
  GROUP BY srcAddr, dstAddr, vpcId, region, subNetId
  HAVING COUNT(DISTINCT dstPort) >=  10
  ORDER BY COUNT(DISTINCT dstPort) DESC
QueryName: "VPC Flow Port Scanning"
Schedule:
  RateMinutes: 60
  TimeoutMinutes: 5

Detection logic

Stage 1: source

panther_logs.public.aws_vpcflow

Stage 2: filter

srcAddr ne "null"
srcPort not in ["443", "80", "2049", "123", "445", "53", "853"]
dstPort not in ["443", "80", "2049", "123", "445", "53", "853"]
flowDirection eq "egress"

Stage 3: having

Threshold
ge 10
Cardinality
dstPort

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
dstPortin123, 2049, 443, 445, 53, 80, 853
srcPortin123, 2049, 443, 445, 53, 80, 853

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
flowDirectioneq
  • egress
srcAddrne
  • null

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
srcAddr
dstAddr
distinctDstPortsCOUNT ( DISTINCT dstPort )
vpcId
region
subNetId