Agent-Initiated Internal Network Service Sweep
This rule flags an AI agent that runs a broad network scan across many hosts and ports instead of checking a single known address. That kind of sweep is normally what an attacker does before trying to move deeper into a network, and it's a sign the agent has been steered into doing more than its task requires.
How the attack works
An attacker manipulates the agent's instructions or goals so it issues a tool call that scans a whole subnet or IP range across many ports, using nmap/masscan-style flags or an equivalent scripted loop. This maps out which internal hosts and services are reachable. The result gives the attacker a list of live targets and open ports to attack next, i.e. the reconnaissance step before lateral movement. It differs from a normal single host:port connectivity check, which this rule does not flag.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f856b4b2-0c58-4eaf-914a-3120d4d3006a
- Severity
- High
Why it matters
If successful, an attacker gets a map of internal hosts and open services, information used to plan further intrusion into other systems on the network. The rule only catches this reconnaissance step, not any later exploitation.
What you can do
- →Restrict the agent's network egress so it cannot reach internal subnets it has no legitimate reason to touch.
- →Require explicit approval before an agent runs any command matching CIDR ranges plus port ranges.
- →Allowlist known, authorized scanning tools and accounts (e.g. security team vulnerability scans) so real alerts stand out.
- →Review agent instructions and skill prompts for language that could be manipulated into requesting broad network scans.
Known benign look-alikes
- Authorized internal vulnerability scanning by a security team (context-dependent, requires allowlisting the agent)
- A documented single scan command referenced in security training material