# Network Reconnaissance Activity

- **Severity:** High
- **Signature ID:** `5ab0c6d8-c202-5f02-b71c-f0228052c20d`
- **MITRE ATLAS:** AML.T0006 (Active Scanning), AML.T0089 (Process Discovery)
- **OWASP:** ASI02 (Tool Misuse and Exploitation)

## Summary

This rule flags an AI agent scanning a network for open ports and live hosts — the kind of reconnaissance that usually happens before an attacker tries to move to other systems. It catches this whether the scanner is invoked directly by the agent's tooling or launched indirectly through a shell command or script the agent wrote.

## How the attack works

An agent (or something controlling it) decides to enumerate the network it's running in. It invokes a scanning tool such as nmap, either directly as a recognized tool action or indirectly by writing a script and executing it through something like 'bash -c'. The scan returns a list of reachable hosts and open services. That information is then used to pick targets for further access attempts, i.e. lateral movement.

## Why it matters

An attacker who reaches this stage learns what else is reachable from the compromised agent, which shapes their next move toward other systems or services. This detection covers only the reconnaissance step, not any later compromise.

## What you can do

- Restrict outbound network access from agent execution environments to only what the agent's task requires.
- Review any scanner tool calls or subprocess-launched scans for a legitimate business reason before dismissing them.
- Maintain a list of approved vulnerability scanning and asset inventory jobs so unexpected scans stand out.
- Log and monitor subprocess execution by agents, not just their recognized tool calls, since scans can be launched via scripts to avoid tool-level detection.

## Known benign look-alikes

- Authorised internal vulnerability scanning and asset inventory runs
- Developers checking whether a service is listening on a remote host
- CI pipelines waiting on a dependency's port to open before running tests

## References

- https://attack.mitre.org/techniques/T1046/
- https://attack.mitre.org/techniques/T1040/

---
Source: https://www.netzilo.com/threats/network-recon