I'm reading an Information Security book and am faced with the question:
Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())?
Why might it be?
Nmap, like any adversary tool, can be fingerprinted by Intrusion Detection Systems (IDS). As such, any of Nmap's techniques are generally classified as an attack by these modern tools -- especially Next-generation Firewall (NGFW) technologies, or the bleeding-edge equivalents of NGFWs.
Additionally, information sharing alliance centers (ISACs) are sharing Cyber Threat Intelligence (CTI) indicators (often shown as Indicators of Compromise, or IoCs) that involve either
Which book are you referring to? Given the context, it appears that the author is discussing how SYN scans are potentially more noisy on a network than TCP connect() scans. This is because the SYN scan does not complete the full TCP handshake. Again, IDS/IPS, UTM, NGFW, and CTI defensive techniques will detect the SYN scan, much like many other Nmap methods and many other network penetration-testing tools and techniques.
A stealth scan would not necessarily attract more attention than a connect scan, the whole point of a stealth scan is to attract less.
What this book may be implying is that a stealth scan is more of a concern than a connect scan. Connect scans can be used to simply gain information about what is online, they don't try to hide what they are doing. An IDS/IPS system should pick one up right away. If an attacker is running a connect scan they are probably less sophisticated/skilled, and therefore less of a threat. If someone is running a stealth scan they are much more likely to know what they are doing, and be harder to detect.