Agent-Initiated Internal Network Service Sweep - ATR-2026-01989 (4b73206d-c2dd-5313-b15c-77f4674d5773)
Detects a tool call that performs a broad internal network service scan — a CIDR/range sweep across a port range using nmap/masptcan-style flags, or a scripted loop that connects to a subnet across many ports. In an agent context this is the ATT&CK T1046 (Network Service Discovery) action: the agent is being driven to map the internal network as a precursor to lateral movement, rather than checking one known host:port. Detects: CIDR + port-range scan flags, or subnet for-loop port probes. Does NOT detect: a single-host connectivity check (curl/nc host port), or a documented scan command inside skill prose without range+portrange together.