How Does a Nmap Scan Look in System and Network Logs?

A port scan, akin to a digital burglar checking all the door handles on a street, is a fundamental reconnaissance tactic in cyber attacks. In a simulated lab setting, a Kali Linux machine acts as the attacker, probing a local virtual machine as the target. The attacker executes a SYN stealth scan with Nmap, scanning ports 1 through 100 on the target's IP address.

Upon capturing network traffic, the usual TCP Three-Way Handshake is disrupted by the port scan. Normally, a client sends a SYN packet, and the server responds with a SYN-ACK, which the client completes with an ACK. However, during a port scan, the scanner instantly sends a RST packet upon receiving the SYN-ACK, halting the handshake. This tactic aims to prevent full connection logs from being recorded in application layers, but network monitors can still detect the rapid series of SYN - RST packets.

System logs on the targeted operating system may show a surge in connection attempts. On Windows, Windows Defender Firewall with Advanced Security logs can reveal a flood of dropped or allowed packets. In Linux, kernel logs or packet filtering logs (such as iptables or nftables) might contain warnings about unhandled connection drops due to the rapid influx of packets targeting closed ports.

Security Operations Centers (SOCs) typically rely on Security Information and Event Management (SIEM) tools to automatically detect these activities, rather than manually reviewing logs. These tools process the logs and generate alerts to help security analysts identify and respond to potential threats. Understanding how offensive tools manifest themselves in defensive logs is crucial for Blue Team analysts seeking to enhance threat detection capabilities.