Identifies SIP OPTIONS requests from a single source that target many distinct extension usernames within a two‑minute window. The rule parses SIP signaling from decoded network traffic (fields network_traffic.sip.* or sip.*) to extract method, target username (to_user), and user agent, along with client_ip and server_ip. It computes a 2-minute window and aggregates per client/server pair, counting total requests and distinct to_user values. When a single client contacts 20 or more distinct extensions within the window, an alert is raised. This pattern is typical of SIP discovery scans by attackers or VoIP scanners aiming to map valid users prior to REGISTER brute force, toll fraud, or hijacking attempts. The rule maps to MITRE ATT&CK techniques T1046 (Network Service Discovery) and T1595 (Active Scanning). It includes guidance for triage and investigation, false positives handling, and recommended responses. Setup requires the Elastic network_traffic integration with a SIP module and decoded SIP headers (SIP over TLS is not visible unless decrypted; TLS termination is assumed). The rule can be noisy, so a suppression strategy groups on source and destination to reduce duplicates. False positives commonly arise from legitimate provisioning, extension audits, or SBC health checks; such sources should be documented and exempted after verification. Recommended responses include blocking the offending client IP at SBC/perimeter, enforcing SIP authentication and rate limits, and hunting for follow‑on credential or toll‑fraud activity from the same source.