Compromised devices on your network may scan the rest of your network, this will allow the attacker to find further vulnerabilities and pivot around your network. If a machine is performing a scan on its own network segment and the scanning activity is never leaving that network segment, then detection by a SIEM will depend on how that network segment is configured to collecting logs and forward them either directly to the SIEM or to a central location that will connect to the SIEM.
In general most SIEM solutions will have connectors or parsers that automatically collect logs for things like port scans without a great deal of configuration being required, these logs may be from a central repository that collects the all the host based Windows firewall logs (or other 3rd party host based firewall logs, or something similar) and then parse them into the SIEM. The exact topology can vary depending on what is required. All the standard TCP or UDP scanning techniques should be easily recognized by the SIEM and come with the build in content.
Ideally assets with high criticality will be tied down with strict ACL’s so that any anomalous behaviour will be easily spotted by simply configuring a rule saying; If any highly critical device receives any layer 4 traffic from any asset that it is not supposed to, fire a rule which will generate an alert.
Depending on the SIEM tool you are using will depend on how you go about this.
For a general ‘catch all windows port scanning’, the filter for detecting the port scan should look something like the following;
Device Vendor = Microsoft
Device Product = Windows
Category Behaviour = Port Scan (TCP segments with certain flag settings on N+ ports)
Category Outcome = Success OR Failure (TCP Connection complete or not)
Device type != Firewall
Aggregate if the following is true
Target port = unique (Each port should be unique, i.e port 80, 8080, 443, 22 etc)
Attacker address = identical (All traffic originating from the same IP)
Attacker zone = identical (This can be a tag you have configured in your SIEM to UID heterogeneous areas of your environment('s))
Target address = range of IP address (a VLAN for example)
You can then write a rule that says on every event or any N number of correlated events matching the criteria of the filter generate an alert.
Disclaimer: This rule is really for explanation purposes and is likely generate a lot of noise and false positives, so it will require a great deal of tuning and testing to ensure it is harmonious and tailored to your environment. Additionally there are many differing ways to achieve the same result, but this is how I would personally tackle this problem.