[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEFK0N7JCKJ528C6QPB5MM":3,"skill-same:01M6AEFK0N7JCKJ528C6QPB5MM":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6AEFK0N7JCKJ528C6QPB5MM","detecting-network-scanning-with-ids-signatures",null,"Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-scanning-with-ids-signatures\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"network","ids","detecting network scanning with ids signatures","security","cybersecurity","pr","network-security","reconnaissance","Nmap","snort","suricata","detection","nmap-detection","port-scanning","signature-detection","threshold-rules","2026-11-10 10:12:30",false,"---\nname: detecting-network-scanning-with-ids-signatures\ndescription: Detect network reconnaissance and port scanning using Suricata and Snort\n  IDS signatures, threshold-based detection rules, and traffic anomaly analysis to\n  identify Nmap, Masscan, and custom scanning activity.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- ids\n- nmap-detection\n- port-scanning\n- snort\n- suricata\n- reconnaissance\n- network-security\n- signature-detection\n- threshold-rules\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1595\n---\n\n# Detecting Network Scanning with IDS Signatures\n\n## Overview\n\nNetwork scanning is typically the first phase of an attack, where adversaries enumerate live hosts, open ports, running services, and OS versions using tools like Nmap, Masscan, ZMap, and custom scanners. Detecting this reconnaissance activity provides early warning of potential attacks. IDS\u002FIPS systems like Suricata and Snort can identify scanning through signature-based detection (matching known scanner packet patterns), threshold-based detection (counting connection attempts over time), and anomaly detection (identifying unusual traffic patterns). This skill covers writing and deploying IDS signatures for scan detection, configuring threshold-based alerting, and correlating scan activity with downstream attack indicators.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting network scanning with ids signatures\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Suricata 7.0+ or Snort 3.0+ deployed in IDS\u002FIPS mode\n- Network TAP or SPAN port for traffic visibility\n- Emerging Threats ruleset enabled\n- Logging infrastructure for alert analysis (ELK Stack, Splunk)\n- Baseline understanding of normal network traffic patterns\n\n## Core Concepts\n\n### Scanning Techniques and Detection Indicators\n\n| Scan Type | Nmap Flag | Packet Characteristics | Detection Method |\n|-----------|-----------|----------------------|------------------|\n| **TCP SYN** | `-sS` | SYN flag only, no completion | SYN without SYN\u002FACK response pattern |\n| **TCP Connect** | `-sT` | Full 3-way handshake | Multiple connections from single source |\n| **TCP FIN** | `-sF` | FIN flag only | FIN to closed port (RST response) |\n| **TCP Xmas** | `-sX` | FIN+PSH+URG flags | Unusual flag combination |\n| **TCP NULL** | `-sN` | No flags set | Zero-flag TCP packet |\n| **UDP Scan** | `-sU` | UDP to many ports | ICMP port unreachable responses |\n| **ACK Scan** | `-sA` | ACK flag only (firewall probing) | Unsolicited ACK packets |\n| **SYN\u002FACK Scan** | Custom | SYN+ACK without prior SYN | State violation |\n| **OS Fingerprint** | `-O` | Unusual TCP options\u002Fwindow sizes | Specific option combinations |\n| **Version Detect** | `-sV` | Service probe strings | Known probe payloads |\n\n### Nmap Timing Templates\n\n| Template | Nmap Flag | Speed | Detection Difficulty |\n|----------|-----------|-------|---------------------|\n| Paranoid | `-T0` | 1 probe\u002F5 min | Very difficult |\n| Sneaky | `-T1` | 1 probe\u002F15 sec | Difficult |\n| Polite | `-T2` | 1 probe\u002F0.4 sec | Moderate |\n| Normal | `-T3` | Default parallelism | Easy |\n| Aggressive | `-T4` | Parallel, 1.25s timeout | Very easy |\n| Insane | `-T5` | Maximum parallelism | Trivial |\n\n## Workflow\n\n### Step 1: Deploy Suricata Scan Detection Rules\n\nCreate `\u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Fscan-detection.rules`:\n\n```\n# === TCP Scan Detection ===\n\n# Detect TCP SYN scan (high volume SYN without completion)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP SYN Scan Detected\"; flags:S,12; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000001; rev:2;)\n\n# Detect TCP FIN scan\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP FIN Scan\"; flags:F,12; threshold:type both,track by_src,count 20,seconds 60; classtype:attempted-recon; sid:5000002; rev:1;)\n\n# Detect TCP Xmas scan (FIN+PSH+URG)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP Xmas Tree Scan\"; flags:FPU,12; classtype:attempted-recon; sid:5000003; rev:1;)\n\n# Detect TCP NULL scan (no flags)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP NULL Scan\"; flags:0,12; classtype:attempted-recon; sid:5000004; rev:1;)\n\n# Detect ACK scan (firewall probing)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP ACK Scan\"; flags:A,12; flow:stateless; threshold:type both,track by_src,count 50,seconds 30; classtype:attempted-recon; sid:5000005; rev:1;)\n\n# Detect SYN+ACK scan (unusual stateless probe)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP SYN-ACK Scan\"; flags:SA,12; flow:stateless; threshold:type both,track by_src,count 30,seconds 30; classtype:attempted-recon; sid:5000006; rev:1;)\n\n# === UDP Scan Detection ===\n\n# Detect UDP port scan\nalert udp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN UDP Port Scan\"; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000010; rev:1;)\n\n# === Nmap Specific Detection ===\n\n# Detect Nmap OS fingerprinting (T1 probe - ECN SYN)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap OS Fingerprint Probe\"; flags:SEC,12; window:1; classtype:attempted-recon; sid:5000020; rev:1;)\n\n# Detect Nmap window scan (specific window size patterns)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap Window Size Probe\"; flags:A,12; flow:stateless; window:1024; threshold:type both,track by_src,count 10,seconds 30; classtype:attempted-recon; sid:5000021; rev:1;)\n\n# Detect Nmap version detection probes\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap Service Version Probe\"; flow:established; content:\"HELP\"; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-recon; sid:5000022; rev:1;)\n\n# Detect Nmap scripting engine (NSE)\nalert http $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap NSE HTTP Script\"; http.user_agent; content:\"Nmap Scripting Engine\"; classtype:attempted-recon; sid:5000023; rev:1;)\n\n# === Masscan Detection ===\n\n# Detect Masscan SYN scan (specific window size)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Masscan SYN Scan Detected\"; flags:S,12; window:1024; threshold:type both,track by_src,count 100,seconds 10; classtype:attempted-recon; sid:5000030; rev:1;)\n\n# === Internal Scan Detection ===\n\n# Detect internal host scanning (lateral movement recon)\nalert tcp $HOME_NET any -> $HOME_NET any (msg:\"SCAN Internal Network Scan Detected\"; flags:S,12; threshold:type both,track by_src,count 50,seconds 30; classtype:attempted-recon; sid:5000040; rev:1;)\n\n# Detect internal ICMP sweep\nalert icmp $HOME_NET any -> $HOME_NET any (msg:\"SCAN Internal ICMP Sweep\"; itype:8; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000041; rev:1;)\n```\n\n### Step 2: Configure Threshold-Based Detection\n\nEdit `\u002Fetc\u002Fsuricata\u002Fthreshold.config`:\n\n```\n# Suppress scan alerts from authorized vulnerability scanners\nsuppress gen_id 1, sig_id 5000001, track by_src, ip 10.0.5.100\nsuppress gen_id 1, sig_id 5000001, track by_src, ip 10.0.5.101\n\n# Rate-limit scan alerts to prevent log flooding\nrate_filter gen_id 1, sig_id 5000001, track by_src, count 5, seconds 300, new_action alert, timeout 600\nrate_filter gen_id 1, sig_id 5000040, track by_src, count 3, seconds 300, new_action alert, timeout 600\n\n# Event filter for critical internal scans\nevent_filter gen_id 1, sig_id 5000040, type both, track by_src, count 1, seconds 60\n```\n\n### Step 3: Scan Detection Analysis Script\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze IDS alerts for network scanning activity and generate reports.\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime\n\n\nclass ScanDetector:\n    \"\"\"Correlate IDS alerts to identify scanning campaigns.\"\"\"\n\n    def __init__(self):\n        self.scan_events = defaultdict(lambda: {\n            'source_ip': '',\n            'target_ips': set(),\n            'target_ports': set(),\n            'scan_types': set(),\n            'alert_count': 0,\n            'first_seen': None,\n            'last_seen': None,\n            'signatures': defaultdict(int),\n        })\n\n    def process_eve_json(self, filepath: str):\n        \"\"\"Process Suricata EVE JSON alert log.\"\"\"\n        with open(filepath, 'r') as f:\n            for line in f:\n                try:\n                    event = json.loads(line)\n                    if event.get('event_type') != 'alert':\n                        continue\n\n                    alert = event.get('alert', {})\n                    sig = alert.get('signature', '')\n\n                    if 'SCAN' not in sig:\n                        continue\n\n                    src_ip = event.get('src_ip', '')\n                    dst_ip = event.get('dest_ip', '')\n                    dst_port = event.get('dest_port', 0)\n                    ts = datetime.fromisoformat(\n                        event['timestamp'].replace('Z', '+00:00')\n                    )\n\n                    scanner = self.scan_events[src_ip]\n                    scanner['source_ip'] = src_ip\n                    scanner['target_ips'].add(dst_ip)\n                    scanner['target_ports'].add(dst_port)\n                    scanner['alert_count'] += 1\n                    scanner['signatures'][sig] += 1\n\n                    if 'SYN' in sig:\n                        scanner['scan_types'].add('SYN Scan')\n                    elif 'FIN' in sig:\n                        scanner['scan_types'].add('FIN Scan')\n                    elif 'Xmas' in sig:\n                        scanner['scan_types'].add('Xmas Scan')\n                    elif 'NULL' in sig:\n                        scanner['scan_types'].add('NULL Scan')\n                    elif 'UDP' in sig:\n                        scanner['scan_types'].add('UDP Scan')\n                    elif 'Nmap' in sig:\n                        scanner['scan_types'].add('Nmap Detected')\n                    elif 'Masscan' in sig:\n                        scanner['scan_types'].add('Masscan Detected')\n                    elif 'Internal' in sig:\n                        scanner['scan_types'].add('Internal Scan')\n\n                    if scanner['first_seen'] is None or ts \u003C scanner['first_seen']:\n                        scanner['first_seen'] = ts\n                    if scanner['last_seen'] is None or ts > scanner['last_seen']:\n                        scanner['last_seen'] = ts\n\n                except (json.JSONDecodeError, KeyError, ValueError):\n                    continue\n\n    def generate_report(self):\n        \"\"\"Generate scan detection report.\"\"\"\n        scanners = sorted(\n            self.scan_events.values(),\n            key=lambda x: x['alert_count'],\n            reverse=True\n        )\n\n        print(f\"\\n{'='*70}\")\n        print(\"NETWORK SCAN DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Unique Scanning Sources: {len(scanners)}\\n\")\n\n        for scanner in scanners:\n            targets = len(scanner['target_ips'])\n            ports = len(scanner['target_ports'])\n            duration = (scanner['last_seen'] - scanner['first_seen']).total_seconds() \\\n                if scanner['first_seen'] and scanner['last_seen'] else 0\n\n            is_internal = scanner['source_ip'].startswith(('10.', '172.', '192.168.'))\n            severity = \"CRITICAL\" if is_internal else \\\n                       \"HIGH\" if targets > 50 or ports > 100 else \"MEDIUM\"\n\n            print(f\"[{severity}] Scanner: {scanner['source_ip']}\")\n            print(f\"  Type: {'INTERNAL' if is_internal else 'EXTERNAL'}\")\n            print(f\"  Scan Types: {', '.join(scanner['scan_types'])}\")\n            print(f\"  Target Hosts: {targets}, Target Ports: {ports}\")\n            print(f\"  Total Alerts: {scanner['alert_count']}\")\n            print(f\"  Duration: {duration:.0f}s\")\n            print(f\"  First Seen: {scanner['first_seen']}\")\n            print(f\"  Top Signatures:\")\n            for sig, count in sorted(\n                scanner['signatures'].items(), key=lambda x: x[1], reverse=True\n            )[:5]:\n                print(f\"    - {sig}: {count}\")\n            print()\n\n\nif __name__ == '__main__':\n    detector = ScanDetector()\n    log_file = sys.argv[1] if len(sys.argv) > 1 else '\u002Fvar\u002Flog\u002Fsuricata\u002Feve.json'\n    detector.process_eve_json(log_file)\n    detector.generate_report()\n```\n\n## Response Playbook\n\n1. **Triage** - Determine if scan is from authorized scanner or unknown source\n2. **Enrich** - Look up source IP in threat intelligence feeds\n3. **Assess Scope** - Count unique targets and ports to gauge scan breadth\n4. **Block** - Add aggressive external scanners to firewall block list\n5. **Investigate Internal** - Internal scans may indicate compromised host; isolate and investigate\n6. **Correlate** - Check if scan was followed by exploitation attempts\n\n## Best Practices\n\n- **Whitelist Authorized Scanners** - Suppress alerts from known vulnerability scanner IPs\n- **Focus on Internal Scans** - Internal scanning is higher severity than external (indicates compromise)\n- **Threshold Tuning** - Adjust thresholds based on environment; a \u002F16 network sees more scan noise\n- **Correlate with Other Alerts** - Combine scan detection with exploitation alerts for kill chain visibility\n- **Time-Based Analysis** - Scans at unusual hours (3 AM) warrant higher priority\n- **Rate Limit Alerts** - Prevent scan floods from overwhelming the SIEM with noise\n\n## References\n\n- [Suricata Rules Documentation](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002Frules\u002Findex.html)\n- [Nmap IDS Evasion Techniques](https:\u002F\u002Fnmap.org\u002Fbook\u002Fsubvert-ids.html)\n- [OPNsense Suricata Nmap Detection Rules](https:\u002F\u002Fgithub.com\u002Faleksibovellan\u002Fopnsense-suricata-nmaps)\n- [Emerging Threats Ruleset](https:\u002F\u002Frules.emergingthreats.net\u002F)\n","# Detecting Network Scanning with IDS Signatures\n\n## Overview\n\nNetwork scanning is typically the first phase of an attack, where adversaries enumerate live hosts, open ports, running services, and OS versions using tools like Nmap, Masscan, ZMap, and custom scanners. Detecting this reconnaissance activity provides early warning of potential attacks. IDS\u002FIPS systems like Suricata and Snort can identify scanning through signature-based detection (matching known scanner packet patterns), threshold-based detection (counting connection attempts over time), and anomaly detection (identifying unusual traffic patterns). This skill covers writing and deploying IDS signatures for scan detection, configuring threshold-based alerting, and correlating scan activity with downstream attack indicators.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting network scanning with ids signatures\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Suricata 7.0+ or Snort 3.0+ deployed in IDS\u002FIPS mode\n- Network TAP or SPAN port for traffic visibility\n- Emerging Threats ruleset enabled\n- Logging infrastructure for alert analysis (ELK Stack, Splunk)\n- Baseline understanding of normal network traffic patterns\n\n## Core Concepts\n\n### Scanning Techniques and Detection Indicators\n\n| Scan Type | Nmap Flag | Packet Characteristics | Detection Method |\n|-----------|-----------|----------------------|------------------|\n| **TCP SYN** | `-sS` | SYN flag only, no completion | SYN without SYN\u002FACK response pattern |\n| **TCP Connect** | `-sT` | Full 3-way handshake | Multiple connections from single source |\n| **TCP FIN** | `-sF` | FIN flag only | FIN to closed port (RST response) |\n| **TCP Xmas** | `-sX` | FIN+PSH+URG flags | Unusual flag combination |\n| **TCP NULL** | `-sN` | No flags set | Zero-flag TCP packet |\n| **UDP Scan** | `-sU` | UDP to many ports | ICMP port unreachable responses |\n| **ACK Scan** | `-sA` | ACK flag only (firewall probing) | Unsolicited ACK packets |\n| **SYN\u002FACK Scan** | Custom | SYN+ACK without prior SYN | State violation |\n| **OS Fingerprint** | `-O` | Unusual TCP options\u002Fwindow sizes | Specific option combinations |\n| **Version Detect** | `-sV` | Service probe strings | Known probe payloads |\n\n### Nmap Timing Templates\n\n| Template | Nmap Flag | Speed | Detection Difficulty |\n|----------|-----------|-------|---------------------|\n| Paranoid | `-T0` | 1 probe\u002F5 min | Very difficult |\n| Sneaky | `-T1` | 1 probe\u002F15 sec | Difficult |\n| Polite | `-T2` | 1 probe\u002F0.4 sec | Moderate |\n| Normal | `-T3` | Default parallelism | Easy |\n| Aggressive | `-T4` | Parallel, 1.25s timeout | Very easy |\n| Insane | `-T5` | Maximum parallelism | Trivial |\n\n## Workflow\n\n### Step 1: Deploy Suricata Scan Detection Rules\n\nCreate `\u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Fscan-detection.rules`:\n\n```\n# === TCP Scan Detection ===\n\n# Detect TCP SYN scan (high volume SYN without completion)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP SYN Scan Detected\"; flags:S,12; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000001; rev:2;)\n\n# Detect TCP FIN scan\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP FIN Scan\"; flags:F,12; threshold:type both,track by_src,count 20,seconds 60; classtype:attempted-recon; sid:5000002; rev:1;)\n\n# Detect TCP Xmas scan (FIN+PSH+URG)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP Xmas Tree Scan\"; flags:FPU,12; classtype:attempted-recon; sid:5000003; rev:1;)\n\n# Detect TCP NULL scan (no flags)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP NULL Scan\"; flags:0,12; classtype:attempted-recon; sid:5000004; rev:1;)\n\n# Detect ACK scan (firewall probing)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP ACK Scan\"; flags:A,12; flow:stateless; threshold:type both,track by_src,count 50,seconds 30; classtype:attempted-recon; sid:5000005; rev:1;)\n\n# Detect SYN+ACK scan (unusual stateless probe)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN TCP SYN-ACK Scan\"; flags:SA,12; flow:stateless; threshold:type both,track by_src,count 30,seconds 30; classtype:attempted-recon; sid:5000006; rev:1;)\n\n# === UDP Scan Detection ===\n\n# Detect UDP port scan\nalert udp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN UDP Port Scan\"; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000010; rev:1;)\n\n# === Nmap Specific Detection ===\n\n# Detect Nmap OS fingerprinting (T1 probe - ECN SYN)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap OS Fingerprint Probe\"; flags:SEC,12; window:1; classtype:attempted-recon; sid:5000020; rev:1;)\n\n# Detect Nmap window scan (specific window size patterns)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap Window Size Probe\"; flags:A,12; flow:stateless; window:1024; threshold:type both,track by_src,count 10,seconds 30; classtype:attempted-recon; sid:5000021; rev:1;)\n\n# Detect Nmap version detection probes\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap Service Version Probe\"; flow:established; content:\"HELP\"; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-recon; sid:5000022; rev:1;)\n\n# Detect Nmap scripting engine (NSE)\nalert http $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Nmap NSE HTTP Script\"; http.user_agent; content:\"Nmap Scripting Engine\"; classtype:attempted-recon; sid:5000023; rev:1;)\n\n# === Masscan Detection ===\n\n# Detect Masscan SYN scan (specific window size)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"SCAN Masscan SYN Scan Detected\"; flags:S,12; window:1024; threshold:type both,track by_src,count 100,seconds 10; classtype:attempted-recon; sid:5000030; rev:1;)\n\n# === Internal Scan Detection ===\n\n# Detect internal host scanning (lateral movement recon)\nalert tcp $HOME_NET any -> $HOME_NET any (msg:\"SCAN Internal Network Scan Detected\"; flags:S,12; threshold:type both,track by_src,count 50,seconds 30; classtype:attempted-recon; sid:5000040; rev:1;)\n\n# Detect internal ICMP sweep\nalert icmp $HOME_NET any -> $HOME_NET any (msg:\"SCAN Internal ICMP Sweep\"; itype:8; threshold:type both,track by_src,count 30,seconds 10; classtype:attempted-recon; sid:5000041; rev:1;)\n```\n\n### Step 2: Configure Threshold-Based Detection\n\nEdit `\u002Fetc\u002Fsuricata\u002Fthreshold.config`:\n\n```\n# Suppress scan alerts from authorized vulnerability scanners\nsuppress gen_id 1, sig_id 5000001, track by_src, ip 10.0.5.100\nsuppress gen_id 1, sig_id 5000001, track by_src, ip 10.0.5.101\n\n# Rate-limit scan alerts to prevent log flooding\nrate_filter gen_id 1, sig_id 5000001, track by_src, count 5, seconds 300, new_action alert, timeout 600\nrate_filter gen_id 1, sig_id 5000040, track by_src, count 3, seconds 300, new_action alert, timeout 600\n\n# Event filter for critical internal scans\nevent_filter gen_id 1, sig_id 5000040, type both, track by_src, count 1, seconds 60\n```\n\n### Step 3: Scan Detection Analysis Script\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Analyze IDS alerts for network scanning activity and generate reports.\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime\n\n\nclass ScanDetector:\n    \"\"\"Correlate IDS alerts to identify scanning campaigns.\"\"\"\n\n    def __init__(self):\n        self.scan_events = defaultdict(lambda: {\n            'source_ip': '',\n            'target_ips': set(),\n            'target_ports': set(),\n            'scan_types': set(),\n            'alert_count': 0,\n            'first_seen': None,\n            'last_seen': None,\n            'signatures': defaultdict(int),\n        })\n\n    def process_eve_json(self, filepath: str):\n        \"\"\"Process Suricata EVE JSON alert log.\"\"\"\n        with open(filepath, 'r') as f:\n            for line in f:\n                try:\n                    event = json.loads(line)\n                    if event.get('event_type') != 'alert':\n                        continue\n\n                    alert = event.get('alert', {})\n                    sig = alert.get('signature', '')\n\n                    if 'SCAN' not in sig:\n                        continue\n\n                    src_ip = event.get('src_ip', '')\n                    dst_ip = event.get('dest_ip', '')\n                    dst_port = event.get('dest_port', 0)\n                    ts = datetime.fromisoformat(\n                        event['timestamp'].replace('Z', '+00:00')\n                    )\n\n                    scanner = self.scan_events[src_ip]\n                    scanner['source_ip'] = src_ip\n                    scanner['target_ips'].add(dst_ip)\n                    scanner['target_ports'].add(dst_port)\n                    scanner['alert_count'] += 1\n                    scanner['signatures'][sig] += 1\n\n                    if 'SYN' in sig:\n                        scanner['scan_types'].add('SYN Scan')\n                    elif 'FIN' in sig:\n                        scanner['scan_types'].add('FIN Scan')\n                    elif 'Xmas' in sig:\n                        scanner['scan_types'].add('Xmas Scan')\n                    elif 'NULL' in sig:\n                        scanner['scan_types'].add('NULL Scan')\n                    elif 'UDP' in sig:\n                        scanner['scan_types'].add('UDP Scan')\n                    elif 'Nmap' in sig:\n                        scanner['scan_types'].add('Nmap Detected')\n                    elif 'Masscan' in sig:\n                        scanner['scan_types'].add('Masscan Detected')\n                    elif 'Internal' in sig:\n                        scanner['scan_types'].add('Internal Scan')\n\n                    if scanner['first_seen'] is None or ts \u003C scanner['first_seen']:\n                        scanner['first_seen'] = ts\n                    if scanner['last_seen'] is None or ts > scanner['last_seen']:\n                        scanner['last_seen'] = ts\n\n                except (json.JSONDecodeError, KeyError, ValueError):\n                    continue\n\n    def generate_report(self):\n        \"\"\"Generate scan detection report.\"\"\"\n        scanners = sorted(\n            self.scan_events.values(),\n            key=lambda x: x['alert_count'],\n            reverse=True\n        )\n\n        print(f\"\\n{'='*70}\")\n        print(\"NETWORK SCAN DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Unique Scanning Sources: {len(scanners)}\\n\")\n\n        for scanner in scanners:\n            targets = len(scanner['target_ips'])\n            ports = len(scanner['target_ports'])\n            duration = (scanner['last_seen'] - scanner['first_seen']).total_seconds() \\\n                if scanner['first_seen'] and scanner['last_seen'] else 0\n\n            is_internal = scanner['source_ip'].startswith(('10.', '172.', '192.168.'))\n            severity = \"CRITICAL\" if is_internal else \\\n                       \"HIGH\" if targets > 50 or ports > 100 else \"MEDIUM\"\n\n            print(f\"[{severity}] Scanner: {scanner['source_ip']}\")\n            print(f\"  Type: {'INTERNAL' if is_internal else 'EXTERNAL'}\")\n            print(f\"  Scan Types: {', '.join(scanner['scan_types'])}\")\n            print(f\"  Target Hosts: {targets}, Target Ports: {ports}\")\n            print(f\"  Total Alerts: {scanner['alert_count']}\")\n            print(f\"  Duration: {duration:.0f}s\")\n            print(f\"  First Seen: {scanner['first_seen']}\")\n            print(f\"  Top Signatures:\")\n            for sig, count in sorted(\n                scanner['signatures'].items(), key=lambda x: x[1], reverse=True\n            )[:5]:\n                print(f\"    - {sig}: {count}\")\n            print()\n\n\nif __name__ == '__main__':\n    detector = ScanDetector()\n    log_file = sys.argv[1] if len(sys.argv) > 1 else '\u002Fvar\u002Flog\u002Fsuricata\u002Feve.json'\n    detector.process_eve_json(log_file)\n    detector.generate_report()\n```\n\n## Response Playbook\n\n1. **Triage** - Determine if scan is from authorized scanner or unknown source\n2. **Enrich** - Look up source IP in threat intelligence feeds\n3. **Assess Scope** - Count unique targets and ports to gauge scan breadth\n4. **Block** - Add aggressive external scanners to firewall block list\n5. **Investigate Internal** - Internal scans may indicate compromised host; isolate and investigate\n6. **Correlate** - Check if scan was followed by exploitation attempts\n\n## Best Practices\n\n- **Whitelist Authorized Scanners** - Suppress alerts from known vulnerability scanner IPs\n- **Focus on Internal Scans** - Internal scanning is higher severity than external (indicates compromise)\n- **Threshold Tuning** - Adjust thresholds based on environment; a \u002F16 network sees more scan noise\n- **Correlate with Other Alerts** - Combine scan detection with exploitation alerts for kill chain visibility\n- **Time-Based Analysis** - Scans at unusual hours (3 AM) warrant higher priority\n- **Rate Limit Alerts** - Prevent scan floods from overwhelming the SIEM with noise\n\n## References\n\n- [Suricata Rules Documentation](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002Frules\u002Findex.html)\n- [Nmap IDS Evasion Techniques](https:\u002F\u002Fnmap.org\u002Fbook\u002Fsubvert-ids.html)\n- [OPNsense Suricata Nmap Detection Rules](https:\u002F\u002Fgithub.com\u002Faleksibovellan\u002Fopnsense-suricata-nmaps)\n- [Emerging Threats Ruleset](https:\u002F\u002Frules.emergingthreats.net\u002F)\n",{"name":5,"tags":45,"author":46,"domain":28,"license":15,"version":47,"nist_csf":48,"subdomain":30,"description":7,"mitre_attack":53},[25,36,37,33,34,31,30,38,39],"mahipal","1.0",[49,50,51,52],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[54,55,56,57,58],"T1046","T1040","T1557","T1071","T1595","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-network-scanning-with-ids-signatures",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-network-scanning-with-ids-signatures",{"tool":75,"command":76},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-network-scanning-with-ids-signatures",{"tool":78,"command":79},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-network-scanning-with-ids-signatures","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-scanning-with-ids-signatures\u002FSKILL.md",true,[83,88,94],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-scanning-with-ids-signatures\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",1600,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-scanning-with-ids-signatures\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",5818,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-scanning-with-ids-signatures\u002Fscripts\u002Fagent.py",[101,126,150,177,203,230],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":108,"publishedAt":40},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[107],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[109,110,111,112,27,28,113,114,29,115,116,117,118,119,120,121,122,123,124,125],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":40},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[132],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,122,135,136,27,137,28,29,138,139,140,141,142,143,144,145,146,147,148,149],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":160,"publishedAt":40},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[156,159],{"categoryNo":157,"categoryName":158,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[144,161,162,163,164,28,165,166,138,167,168,169,170,171,35,172,173,174,175,176],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":184,"publishedAt":40},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[185,186,187,28,188,189,190,191,192,193,194,195,196,197,198,199,141,200,201,202],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":40},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[209],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,28,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":40},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[236],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,238,28,239,240,241,242,243,244,245,246,172,247,173,248,249,250,251,252,253],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]