> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/runtime-defense/incident-types/port-scanning.md). # Port Scanning Port scans are a method for finding which ports on a network are open and listening. It is a reconnaissance technique that gives attackers a map of where they can further probe for weaknesses. Port scanning incidents indicate that a container is attempting to make an unusual number of outbound network connections to hosts and ports to which it does not normally connect. Port scanning could be a post-compromise attempt to use the container to find other resources on the network as a precursor to lateral movement. Prisma Cloud performs two types of checks for port scanning: * The first type specifically identifies scans done by 'nmap.' This is triggered by a process event, which can be blocked (both alert/block). * The second type of check is triggered by a network event, which cannot be blocked but can only generate an alert. This type of check doesn’t depend on the binary. The scan can be initiated by processes such as a Java process, which would be classified as an alert triggered by raw socket events. This means that even if port scans are done using tools other than 'nmap', they will be alerted as raw socket events. Incidents of this type will show all the target IPs and ports involved in the scan. ## Investigation The following screenshot shows a port scanning incident.
port scanning incident
The first step in an investigation is to determine whether the source of the outbound network activity was an otherwise-valid process that was misused or a newly introduced process. Prisma Cloud forensics are a great place to start. In Incident Explorer, click **View Live Forensics**. It shows that *bin/bash* was launched immediately before the port scan, and that the shell was used to launch nmap. Nmap is a popular network scanning tool.
port scanning forensics
The next step in the investigation is to determine how nmap was introduced and executed. Some plausible scenarios include: * A user account was used to execute nmap via a Docker command from the host. If enabled, Prisma Cloud access logs would show which user ran the command and when it was run. * A remote code execution vulnerability was used to run nmap remotely. If the Prisma Cloud Web Application and API Security (WAAS) was configured to protect this container’s inbound traffic, the WAAS logs may help with your investigation. Additionally, logs from the services in the container, such as Apache access logs, may shed additional light on the incident. Once the cause has been identified, the next step in the investigation is to review the services that the actor may have discovered via port scanning and to inspect those containers to ensure that there hasn’t been additional lateral movement. Container runtime audits may show specific connection attempts. ## Mitigation Mitigation and remediation for a port scanning incident should focus on resolving the issue that allowed execution of the responsible process. ## Blocking port scanning attempts using tools such as nmap, Hping3, and masscan Prisma Cloud Runtime Policy supports detecting and blocking port scanning only for the nmap tool. The nmap tool is detected and blocked as a process, whereas other port scanning tools such as hping3 or masscan are detected as raw socket events. The following examples help validate these scenarios. **Example 1**
port detection event 1
* Message: Process /usr/bin/nmap performed suspicious raw network activity * Event type: Network / Suspicious Network Activity * ATT\&CK technique: Network Service Scanning * Details: Here, Prisma Cloud detects the "nmap -F -Pn 192.168.10.200" event as port scanning and blocks the event. **Example 2**
port detection event 2
* Message: /usr/bin/nmap launched and is identified as a process used for port scanning * Event type: Processes / Port Scan Process * ATT\&CK technique: Network Service Scanning * Details: The message "/usr/bin/nmap launched and is identified as a process used for port scanning" helps Prisma Cloud to block the event. **Example 3**
port detection event 3
* Message: Process /usr/sbin/hping3 performed suspicious raw network activity * Event type: Network / Suspicious Network Activity * ATT\&CK technique: Network Service Scanning * Details: Prisma Cloud detects "hping3 -8 1-1023 192.168.10.200" as a raw network activity, but it does not block it. Prisma Cloud generates a raw socket event. **Example 4**
port detection event 4
* Message: Process /usr/bin/masscan performed suspicious raw network activity * Event type: Network / Suspicious Network Activity * ATT\&CK technique: Man-in-the-Middle * Details: Prisma Cloud detects "masscan 192.168.100.201 -p 1-1023" as a raw network activity, but it does not block it. **Workaround**: You can block the events generated by port scanning tools such as Hping3 and Masscan by using the "Explicitly Denied Processes" option under the Runtime Rule. You can also add processes such as "/usr/bin/masscan" or "/usr/sbin/hping3" for block action. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/runtime-security/runtime-defense/incident-types/port-scanning.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.