Detects the use of Advanced Port Scanner.

Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Detects many failed connection attempts to different ports or hosts

Detects many failed connection attempts to different ports or hosts

Detects enumeration of local or remote network services.

Detects enumeration of local or remote network services.