MediumALERT-4212engine: heuristic

Horizontal Port Scan Detected

analyst review

Raw alert — normalized QRadar offense

asset: file-srv-02
protocol: TCP :22
src_ip: 146.62.77.226
dest_ip: 10.20.4.30
magnitude: 5/10
severity: 4/10
credibility: 5/10
relevance: 4/10
src network: external
events / flows: 925 / 2,346

triggered rules

▹ Recon: Excessive Firewall Denies From Single Host
▹ Recon: Port Scan Detected

full offense JSON

{
  "offense_id": 4212,
  "description": "Horizontal Port Scan Detected :: Port Scan targeting file-srv-02",
  "offense_type": "Source IP",
  "offense_source": "146.62.77.226",
  "magnitude": 5,
  "severity": 4,
  "credibility": 5,
  "relevance": 4,
  "status": "OPEN",
  "source_network": "external",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 925,
  "flow_count": 2346,
  "start_time": "2025-11-03T04:37:00+00:00",
  "last_updated_time": "2025-11-03T04:59:00+00:00",
  "categories": [
    "Reconnaissance",
    "Suspicious Activity"
  ],
  "rules": [
    "Recon: Excessive Firewall Denies From Single Host",
    "Recon: Port Scan Detected"
  ],
  "assigned_to": null,
  "dest_port": 22
}

AI triage

Likely port scan: Horizontal Port Scan Detected from external source 146.62.77.226 against file-srv-02 (10.20.4.30) over TCP, 925 events observed.

MITRE ATT&CK

T1595Active ScanningReconnaissanceconfidence 63%

Alert indicators (Horizontal Port Scan Detected; rules: Recon: Excessive Firewall Denies From Single Host) overlap most strongly with T1595 Active Scanning among the ATT&CK shortlist.

Priority — Medium

Scored Medium based on: QRadar magnitude 5/10; source is external to the network.

Recommended next steps

1.Confirm the scan scope: how many destination ports/hosts were touched by the source IP.
2.Check whether any scanned port returned a SYN-ACK (successful connection) vs. all resets.
3.Block or rate-limit the source IP at the perimeter if it is external and unrecognized.
4.Search for follow-on activity from the same source (exploit attempts, logins).

Suggested hunting query (KQL)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "146.62.77.226" and DestinationIP == "10.20.4.30"
| summarize Events=count() by DestinationPort, Protocol
| order by Events desc

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1595Active Scanning·7.5T1046Network Service Discovery·7T1590Gather Victim Network Information·6T1018Remote System Discovery·4.5T1070.004File Deletion·3.5T1564.005Hidden File System·3.5T1596.005Scan Databases·3.5