SOC-027·Network·Severity: MediumClassification: True PositiveEnvironment: Training Lab

Detection and Triage of Internal Subnet Port Scanning

Analysis of network flow logs and Suricata NIDS alerts detecting horizontal TCP SYN sweep activity from an unauthorized development workstation.

EnvironmentInternal Enterprise Subnet (Virtual Lab)

ToolsSuricata NIDS, Zeek Network Monitor, Wireshark, Brim / Zui

MITRE ATT&CKT1046

Published2026-08-15

Safety & Simulation Disclosure

Environment: Training Lab — This investigation was performed in an isolated training environment. Indicators, systems, accounts, and other data shown here are simulated or sanitized unless otherwise stated.

Executive Summary

Suricata raised an ET SCAN alert for potential Nmap SYN scanning initiated by host 10.10.20.45 targeting the server subnet (10.10.50.0/24). Zeek conn.log analysis identified over 2,400 half-open TCP connections (S0 state) targeting ports 22, 80, 443, 445, 3389, and 8080 within a 90-second duration. The investigation confirmed an intern in software development was running an unauthorized vulnerability scan.

Scenario & Trigger

The security team received multiple concurrent alerts regarding rapid port connection resets and SYN sweep activity across core internal servers.

ET SCAN Potential Nmap TCP SYN Scan Detected2026-08-15 11:34:10 UTC

Source: Suricata NIDS Alert #2000537

[1:2000537:8] ET SCAN Potential Nmap TCP SYN Scan [Classification: Attempted Information Leak] [Priority: 2] {TCP} 10.10.20.45:49182 -> 10.10.50.12:445

Initial Evidence

Source Host: 10.10.20.45 (Hostname: DEV-DEVIN-02.corp.local)
Target Subnet: 10.10.50.0/24 (Production Server VLAN)
Total Targeted Hosts: 48 active IP addresses
Targeted Ports: 21, 22, 23, 25, 80, 139, 443, 445, 1433, 3389, 8080

Investigation Methodology & Narrative

Step 1: Queried Zeek conn.log using Zui/Brim. Filtered for id.orig_h==10.10.20.45 and conn_state=="S0" (Connection attempt seen, no reply). Counted 2,418 S0 records within 90 seconds.

Step 2: Inspected packet capture in Wireshark. Identified classic Nmap TCP SYN scan signatures: TCP window size set to 1024, zero TCP options, sequential incremental source ports.

Step 3: Contacted the device owner DEV-DEVIN-02. Confirmed the user was testing custom Python scripts incorporating nmap CLI against production servers without change authorization.

Step 4: Confirmed no exploit payloads or service banners were retrieved; scan was halted before full TCP handshakes completed.

Incident Timeline

Time (UTC)	Event	Telemetry Source	Analyst Note
11:33:45 UTC	Rapid TCP SYN packets begin originating from 10.10.20.45	Zeek conn.log	Horizontal scan initiated across 10.10.50.0/24
11:34:10 UTC	Suricata triggers rule 2000537	Suricata Fast Log	Alert elevated to SOC triage queue
11:35:15 UTC	Scan stopped by operator	Zeek conn.log	Total duration 90 seconds
11:45:00 UTC	Device user interviewed and policy breach resolved	Incident Ticket	Action logged as unauthorized internal security test; no breach

Indicators of Compromise (IOCs)

Type	Observed Value	Context	Reputation
IPv4	10.10.20.45	Source IP for internal port scan (Dev workstation)	Suspicious

Log Analysis & Telemetry Dissection

Zeek conn.log Analysis ExtractZeek Sensor / conn.log

ts                 id.orig_h     id.orig_p  id.resp_h     id.resp_p  proto  conn_state  history
1755257625.102341  10.10.20.45   49182      10.10.50.12   445        tcp    S0          S
1755257625.102410  10.10.20.45   49183      10.10.50.12   3389       tcp    S0          S
1755257625.102551  10.10.20.45   49184      10.10.50.15   22         tcp    S0          S
1755257625.102602  10.10.20.45   49185      10.10.50.15   80         tcp    S0          S

Analysis Note: conn_state "S0" signifies the scanner sent SYN packets but did not complete the 3-way handshake or the target did not respond.

MITRE ATT&CK Mapping

ID	Technique	Tactic	Observed Evidence
T1046	Network Service Discovery	Discovery	Systematic TCP SYN sweep across internal subnet IP range

Findings & Final Classification

True Positive unauthorized internal reconnaissance. While benign in intent (developer self-testing), unauthorized internal scanning poses availability and compliance risks.

Recommended SOC Response & Hardening

•Implement micro-segmentation firewall rules preventing user/workstation VLANs from directly initiating connections to sensitive server ports (445, 3389).
•Provide developer with isolated testing sandbox containing non-production dummy servers for network script testing.
•Reiterate acceptable use policy regarding vulnerability scanning tools.

Analyst Reflection: What I Learned

• Zeek connection states (like S0 vs SF vs REJ) provide clear context on scan completion without needing to inspect deep packet payloads.

• Internal reconnaissance is often caused by well-intentioned staff; maintaining an objective, blameless investigative stance accelerates resolution.

References & Standards

Back to all investigations View Ian's Resume →