Sig 3002 triggers on 5 syn's packets from (Host A) to (Host B ports 1-1024). Knowing the trigger condition, you can now look at the "attacker" machine... since it's internal, what is it, what does it do?
Network management tools mapping hosts and services will cause this signature to fire since that behavior is really no different than say an nmap scan. It's also conceivable that given the combination of services running on the attacker, normal operation of that box will cause this to trigger.
The next step is to identify what the "attacker" box is, and what it's doing.
