Threat Hunting Exercise: Analyzing Firewall Internal Port Scan Reconnaissance Sweep Dataset
This hunt uses a simulated internal firewall/segmentation log dataset (firewall_portscan_2022-08-24T093000.json) capturing T1046: Network Service Discovery, where a compromised internal host performs a broad TCP port sweep against many peer hosts to map reachable services ahead of lateral movement.
Step 1: Hypothesis Formation
Hypothesis: A single internal host generates connection attempts to a wide range of destination IPs and/or ports in a short window, with a high ratio of denied/reset connections (indicating the host is probing rather than using known services) - consistent with post-compromise internal reconnaissance. Indicators:
- One source IP contacting 20+ distinct destination IPs and/or 50+ distinct destination ports within minutes.
- High proportion (>80%) of connections denied by internal segmentation firewalls or reset by the destination (no listening service).
- Sequential or systematic port ordering (e.g., 21,22,23,25,80,443,3389...) suggesting automated scanning tooling (Nmap, MASSCAN) rather than organic application traffic.
- The source host is a standard workstation/user endpoint, not a designated vulnerability-scanning or asset-management server.
Null Hypothesis: An authorized vulnerability management or asset-discovery scan (e.g., Qualys, Nessus, Rapid7) is running on schedule from an approved scanning host. Invalidate by checking the source IP against the registered scanner inventory and the scan-schedule calendar.
Rationale: Internal port scanning is one of the earliest and most detectable stages of the post-compromise attack lifecycle, occurring before an attacker has established which lateral-movement path will succeed; this hunt validates internal segmentation-firewall deny-log analysis as an early-warning control that can catch an intrusion well before data exfiltration or ransomware deployment.
Step 2: Data Sources and Scope
- Sources: Internal segmentation firewall logs (deny/allow, source/destination/port); NetFlow/IPFIX records between internal subnets; EDR process telemetry on the source host for scanning tool signatures.
- Scope: ~2022-08-24T09:30:00-09:36:00 UTC; Source: WKS-ENG-051 (10.290.6.14, standard developer workstation); Target range: 10.290.0.0/16 (internal server subnets).
- SIEM Queries (Splunk/ELK):
index=firewall src_ip="10.290.6.14" | stats dc(dest_ip) as unique_dests, dc(dest_port) as unique_ports by bucket(_time,5m) | where unique_dests>20 OR unique_ports>50- Deny ratio:
index=firewall src_ip="10.290.6.14" | stats count(eval(action="deny")) as denied, count as total | eval ratio=denied/total - Scanner-inventory cross-check:
| inputlookup approved_scanners.csv | search ip="10.290.6.14"
Step 3: Key Findings
Parsed events (5 shown) confirm WKS-ENG-051 attempted connections to 47 distinct internal hosts across 68 distinct ports in 6 minutes, with a 91% deny/reset rate, and was not a registered scanning asset.
| Timestamp (UTC) | Source | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-24 09:30:04 | WKS-ENG-051 | Firewall (deny) | Connection attempts to 10.290.1.10-10.290.1.60, ports 22,80,443,3389 sequentially | Sweep IOC: sequential IP range and standard-port ordering matches automated scanning tool behavior (Nmap default top-ports scan), not organic application access. |
| 2022-08-24 09:30:04 - 09:36:00 | WKS-ENG-051 | Firewall (aggregate) | 47 distinct destination IPs, 68 distinct destination ports, 91% denied by segmentation policy | Volume/Ratio IOC: no legitimate developer workstation traffic pattern touches this many internal hosts/ports with this high a denial rate in 6 minutes. |
| 2022-08-24 09:31:15 | WKS-ENG-051 → 10.290.1.22 | Firewall (allow) | Connection to port 445 (SMB) succeeded - one of the few allowed hits | Lateral-Movement Target IOC: SMB access success among a broader failed sweep flags a viable next-stage pivot point for the attacker. |
| - | WKS-ENG-051 | (EDR process check) | nmap.exe (portable, run from C:\Users\Public\tools\) active during the scan window | Tooling IOC: confirms use of a known scanning utility, not a legitimate business application generating this traffic. |
| - | - | (scanner inventory check) | WKS-ENG-051 is not listed in the approved vulnerability-scanner inventory; no Qualys/Nessus scan is scheduled for this window | Confirms this is unauthorized reconnaissance, not sanctioned vulnerability management activity. |
Validation:
- Timeline: 6-minute sweep touching 47 hosts and 68 ports with a 91% deny rate, using a portable scanning tool - matches textbook internal reconnaissance behavior following an initial compromise.
- False Positives: the source is a standard developer workstation, not a registered scanner; no scheduled vulnerability-management scan corresponds to this window or source IP.
- Correlation: scan volume/ratio, known scanning-tool process, and the one successful SMB hit (a likely next pivot target) together confirm active reconnaissance in progress.
Step 4: Recommendations & Next Steps
- Immediate Response: Isolate WKS-ENG-051 immediately; investigate the successful SMB target (10.290.1.22) for signs of follow-on lateral movement; remove the
nmap.exetooling and determine how/when it was placed on the host; review the user's recent authentication and email activity for the initial access vector. - Detection: Sigma-style rule:
title: Internal Host Performing Broad Port Scan→selection: unique_dest_ips_per_source_5m > 20 AND deny_ratio > 0.8 AND source NOT IN approved_scanner_list. - Pro Tip: Tune internal segmentation firewall alerting specifically on deny-ratio and destination-breadth from non-scanner sources - this single control catches the reconnaissance phase of nearly every hands-on-keyboard intrusion well before any data is touched, giving responders a critical head start.
Hypothesis confirmed - a compromised developer workstation used a portable Nmap scanner to sweep 47 internal hosts across 68 ports, identifying a viable SMB lateral-movement target!