1type: leaky
2name: a1ad/mikrotik-scan-multi_ports
3description: "Detect port scanning from single ip on MikroTik router"
4filter: "evt.Meta.log_type == 'mikrotik_drop' && evt.Meta.service == 'tcp_udp'"
5groupby: evt.Meta.source_ip
6distinct: evt.Parsed.dst_port
7capacity: 15
8leakspeed: 5s
9blackhole: 1m
10labels:
11  service: mikrotik
12  behavior: "tcp:scan"
13  classification:
14    - attack.T1595.001
15    - attack.T1018
16    - attack.T1046
17  spoofable: 2
18  confidence: 1
19  label: "MikroTik Port Scanning"
20  remediation: true
21