Host sweep from source
One source address was denied against many DIFFERENT destination hosts in a short window — a host sweep, the other half of network reconnaissance.
What it detects
One source address was denied against many DIFFERENT destination hosts in a short window — a host sweep, the other half of network reconnaissance. Where a port sweep asks "what is listening on this machine?", this asks "what machines are there?", and it is the usual first move after a foothold on one host.
Counts DISTINCT destination addresses per source. Firing on event volume instead would flag any busy blocked client; the breadth across hosts is the signal.
MITRE ATT&CK mapping
- T1018Remote System Discovery· Discovery
False positives and triage
Asset discovery, vulnerability scanning and network-monitoring platforms sweep hosts as their normal job — identify your own scanners and suppress them by source rather than lowering the threshold, which would only make the rule quieter about real sweeps too.
Backup, patching and configuration-management servers legitimately touch many hosts; if their traffic is being DENIED at this volume that is worth knowing about regardless, as it usually means a policy or routing fault.
A sweep of hosts that are all unreachable looks identical to a misrouted subnet. Check whether the destinations are a contiguous range (a scan) or scattered (more likely a fault), and whether the source has any business reaching them at all.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/network/host_sweep_from_source.yaml, licensed under the Apache License 2.0.
id: network.discovery.host_sweep_from_source
version: 1.0.0
status: stable
severity: medium
confidence: 0.65
platforms: [network]
mitre_techniques: [T1018]
description: |
One source address was denied against many DIFFERENT destination hosts in a short
window — a host sweep, the other half of network reconnaissance. Where a port
sweep asks "what is listening on this machine?", this asks "what machines are
there?", and it is the usual first move after a foothold on one host.
Counts DISTINCT destination addresses per source. Firing on event volume instead
would flag any busy blocked client; the breadth across hosts is the signal.
match:
event_category: network
event_action_any:
- deny
- dropped
- blocked
- client-rst
- server-rst
threshold:
distinct: destination_ip
count: 25
window_seconds: 300
group_by: [source_ip]
correlation_keys: [source_ip]
false_positive_guidance: |
Asset discovery, vulnerability scanning and network-monitoring platforms sweep
hosts as their normal job — identify your own scanners and suppress them by source
rather than lowering the threshold, which would only make the rule quieter about
real sweeps too.
Backup, patching and configuration-management servers legitimately touch many
hosts; if their traffic is being DENIED at this volume that is worth knowing about
regardless, as it usually means a policy or routing fault.
A sweep of hosts that are all unreachable looks identical to a misrouted subnet.
Check whether the destinations are a contiguous range (a scan) or scattered (more
likely a fault), and whether the source has any business reaching them at all.
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.