Detect Port Scanning in AWS VPC Flow Logs

title: AWS VPC Flow — Port Scanning (REJECT fan-out)
id: 7b3e9a42-6c18-4d57-8a21-1f9c4e2d6b05
status: experimental
description: >
  Detects a single source address generating a burst of rejected connections
  across many distinct destination ports in a short window — the signature of a
  horizontal/vertical port scan. REJECT-heavy fan-out from one srcaddr is the
  cheapest reliable network-layer scan indicator.
references:
  - https://attack.mitre.org/techniques/T1046/
author: LogTriage
date: 2026/06/23
modified: 2026/10/20
logsource:
  product: aws
  service: vpcflow
detection:
  selection:
    action: 'REJECT'
  timeframe: 5m
  condition: selection | count(dstport) by srcaddr > 15
falsepositives:
  - Authorized vulnerability scanners (allowlist source IPs)
  - Load balancer / health-check fan-out
level: medium
tags:
  - attack.discovery
  - attack.reconnaissance
  - attack.t1046

What this rule detects

Port scanning is the network-layer reconnaissance step that precedes most targeted attacks: a single source systematically probes a range of ports to find open services. In AWS VPC Flow Logs it has a clean signature — one srcaddr generating many REJECT flows across many distinct dstport values in a short window.

This Sigma rule fires when a single source produces rejected connections to more than 15 distinct destination ports within 5 minutes.

Detection logic

The discriminator is breadth, by source: count(dstport) by srcaddr over action: REJECT. Scanners blindly probe closed ports, so REJECT-heavy fan-out from one IP is the cheapest reliable indicator. Tune the > 15 distinct-port threshold and 5m window to your environment’s baseline.

For open-service discovery (ACCEPT flows), pair this with service-layer detections. LogTriage’s VPC Flow reconnaissance detection clusters flows by source and surfaces the sweep without a SIEM.

Validated against a real sample

Validated against vpc_flow_malicious.log (shipped with LogTriage): a single source (185.220.101.45) generating REJECT flows to 18 distinct destination ports on 10.0.1.50 within about 20 seconds — SSH (22, three times), RDP (3389), SMB (445), databases (1433, 3306, 5432, 6379, 27017) and a spread of other services. That passes the rule’s threshold of more than 15 distinct ports from one source in five minutes. The rule stays silent on the matching benign flow log, where every flow is accepted.

False positives

Authorized vulnerability scanners and your own red-team/security scans look identical at the network layer — allowlist their source IPs. Load balancers and health checkers probing many backends can also resemble fan-out; scope by known infrastructure.