T1592 Gather Victim Host Information Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let ScannerUserAgents = dynamic([
    "masscan", "nmap", "zgrab", "nikto", "sqlmap", "nuclei",
    "dirbuster", "gobuster", "wfuzz", "ffuf", "whatweb",
    "python-requests", "go-http-client", "libwww-perl",
    "shodan", "censys", "binaryedge", "wget/", "lwp-trivial",
    "apachebench", "java/", "ruby"
]);
let FingerPrintPaths = dynamic([
    "/robots.txt", "/.git/", "/.env", "/.env.local", "/.env.production",
    "/phpinfo.php", "/server-status", "/server-info",
    "/crossdomain.xml", "/clientaccesspolicy.xml", "/sitemap.xml",
    "/wp-admin", "/wp-login.php", "/xmlrpc.php",
    "/.well-known/security.txt", "/CHANGELOG.txt", "/readme.html",
    "/web.config", "/WEB-INF/web.xml"
]);
W3CIISLog
| where TimeGenerated > ago(1h)
| where csUserAgent has_any (ScannerUserAgents)
    or csUriStem has_any (FingerPrintPaths)
| extend
    ClientIP       = cIP,
    UserAgent      = csUserAgent,
    RequestPath    = csUriStem,
    ResponseStatus = scStatus,
    ResponseBytes  = scBytes
| summarize
    RequestCount       = count(),
    UniqueUserAgents   = dcount(csUserAgent),
    UniquePaths        = dcount(csUriStem),
    HTTP200Count       = countif(scStatus == 200),
    HTTP404Count       = countif(scStatus == 404),
    FirstRequest       = min(TimeGenerated),
    LastRequest        = max(TimeGenerated),
    SampledUserAgents  = make_set(csUserAgent, 10),
    SampledPaths       = make_set(csUriStem, 15)
    by ClientIP, bin(TimeGenerated, 1h)
| extend
    DurationMinutes = datetime_diff('minute', LastRequest, FirstRequest),
    ReconScore = toint(0)
        + case(RequestCount > 100, 3, RequestCount > 30, 2, RequestCount > 5, 1, 0)
        + case(UniqueUserAgents > 5, 2, UniqueUserAgents > 2, 1, 0)
        + case(UniquePaths > 20, 2, UniquePaths > 8, 1, 0)
        + case(HTTP404Count > 20, 1, 0)
| where ReconScore >= 2
| project
    TimeGenerated, ClientIP, RequestCount, UniqueUserAgents, UniquePaths,
    HTTP200Count, HTTP404Count, DurationMinutes, ReconScore,
    SampledUserAgents, SampledPaths, FirstRequest, LastRequest
| sort by ReconScore desc, RequestCount desc

medium severity low confidence

Data Sources

Microsoft Sentinel - IIS Logs (W3CIISLog)

Required Tables

W3CIISLog

False Positives

Legitimate SEO crawlers such as Googlebot, Bingbot, or commercial crawlers (Screaming Frog, Ahrefs, Semrush) may trigger on path enumeration rules — allowlist known crawler IP ranges and User-Agent prefixes
Internal vulnerability scanners (Nessus, Qualys, Rapid7) run by the security team against web assets will generate identical patterns — exclude known scanner IP ranges via watchlist
Developer tooling such as curl, wget, or Python requests used legitimately by CI/CD pipelines or deployment scripts may match scanner User-Agent patterns — baseline known build server IPs

Splunk

spl

index=web (sourcetype="access_combined" OR sourcetype="iis" OR sourcetype="apache:access") earliest=-1h
| eval ua=lower(useragent)
| eval uri=lower(uri_path)
| eval is_scanner=if(
    match(ua, "masscan|nmap|zgrab|nikto|sqlmap|nuclei|dirbuster|gobuster|wfuzz|ffuf|whatweb|python-requests|go-http-client|libwww-perl|shodan|censys|binaryedge|wget\/|lwp-trivial|apachebench|java\/"),
    1, 0)
| eval is_fingerprint_path=if(
    match(uri, "robots\.txt|\.git\/|\.env|phpinfo\.php|server-status|server-info|crossdomain\.xml|clientaccesspolicy|sitemap\.xml|wp-admin|wp-login\.php|xmlrpc\.php|\.well-known\/security|changelog\.txt|readme\.html|web\.config|web-inf\/web\.xml"),
    1, 0)
| where is_scanner=1 OR is_fingerprint_path=1
| stats
    count                AS request_count,
    dc(useragent)        AS unique_agents,
    dc(uri_path)         AS unique_paths,
    sum(is_scanner)      AS scanner_ua_hits,
    sum(is_fingerprint_path) AS fingerprint_path_hits,
    min(_time)           AS first_seen,
    max(_time)           AS last_seen,
    values(useragent)    AS sampled_agents,
    values(uri_path)     AS sampled_paths,
    count(eval(status=="200")) AS http200_count,
    count(eval(status=="404")) AS http404_count
    by src_ip
| eval duration_mins=round((last_seen - first_seen) / 60, 1)
| eval recon_score=0
| eval recon_score=recon_score + case(request_count > 100, 3, request_count > 30, 2, request_count > 5, 1, true(), 0)
| eval recon_score=recon_score + case(unique_agents > 5, 2, unique_agents > 2, 1, true(), 0)
| eval recon_score=recon_score + case(unique_paths > 20, 2, unique_paths > 8, 1, true(), 0)
| eval recon_score=recon_score + if(http404_count > 20, 1, 0)
| where recon_score >= 2
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table src_ip, request_count, unique_agents, unique_paths, http200_count, http404_count,
        duration_mins, recon_score, scanner_ua_hits, fingerprint_path_hits,
        sampled_agents, sampled_paths, first_seen, last_seen
| sort -recon_score, -request_count

medium severity low confidence

Data Sources

Apache/Nginx access logs IIS access logs

Required Sourcetypes

access_combined iis apache:access

False Positives

Web performance monitoring tools (Pingdom, UptimeRobot, Datadog Synthetics) make regular automated requests with non-browser User-Agents — allowlist their published IP ranges
Internal red team or penetration testing engagements will generate identical fingerprinting patterns — coordinate with security team and exclude authorized test windows
Content delivery network health checks and origin probe traffic from CDN providers (Cloudflare, Fastly, Akamai) may send automated requests that match scanner patterns — allowlist CDN IP blocks

Elastic Security (EQL)

eql

// T1592 — Gather Victim Host Information
any where event.dataset : "iis.access"
  and url.path : ("/.env", "/.git/*", "/phpinfo.php", "/server-status", "/actuator/*")
  or user_agent.original : ("masscan*", "zgrab*", "shodan*", "nuclei*")

medium severity low confidence

Data Sources

Web Server Logs IIS Logs

Required Tables

logs-apache_http_server.* logs-iis.access-*

False Positives

Legitimate SEO crawlers such as Googlebot, Bingbot, or commercial crawlers (Screaming Frog, Ahrefs, Semrush) may trigger on path enumeration rules — allowlist known crawler IP ranges and User-Agent prefixes
Internal vulnerability scanners (Nessus, Qualys, Rapid7) run by the security team against web assets will generate identical patterns — exclude known scanner IP ranges via watchlist
Developer tooling such as curl, wget, or Python requests used legitimately by CI/CD pipelines or deployment scripts may match scanner User-Agent patterns — baseline known build server IPs

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "EventTime",
    LOGSOURCENAME(logsourceid) AS "LogSource",
    LOGSOURCETYPENAME(devicetype) AS "LogSourceType",
    "username", "sourceip", "destinationip",
    "eventid", "deviceaction", "message",
    CASE
        WHEN LOWER("useragent") ILIKE '%masscan%' OR LOWER("useragent") ILIKE '%zgrab%' OR LOWER("useragent") ILIKE '%shodan%' OR LOWER("requesturl") ILIKE '%.env%' OR LOWER("requesturl") ILIKE '%phpinfo%' THEN 8
        ELSE 4
      END AS "RiskScore"
  FROM events
  WHERE (LOWER("useragent") ILIKE '%masscan%' OR LOWER("useragent") ILIKE '%zgrab%' OR LOWER("useragent") ILIKE '%shodan%' OR LOWER("requesturl") ILIKE '%.env%' OR LOWER("requesturl") ILIKE '%phpinfo%')
    AND LOGSOURCETYPENAME(devicetype) NOT IN ('SIM Audit', 'Custom Rule Engine')
  ORDER BY "RiskScore" DESC, "EventTime" DESC
  LAST 24 HOURS

medium severity low confidence

Data Sources

QRadar SIEM Windows Security Events Network Firewall Logs Syslog

Required Tables

events

False Positives

Legitimate SEO crawlers such as Googlebot, Bingbot, or commercial crawlers (Screaming Frog, Ahrefs, Semrush) may trigger on path enumeration rules — allowlist known crawler IP ranges and User-Agent prefixes
Internal vulnerability scanners (Nessus, Qualys, Rapid7) run by the security team against web assets will generate identical patterns — exclude known scanner IP ranges via watchlist
Developer tooling such as curl, wget, or Python requests used legitimately by CI/CD pipelines or deployment scripts may match scanner User-Agent patterns — baseline known build server IPs

Sumo Logic CSE

sql

_sourceCategory=*web* OR _sourceCategory=*iis* OR _sourceCategory=*apache*
| parse regex "(?<client_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})"
| where useragent matches "*masscan*" or useragent matches "*zgrab*" or useragent matches "*shodan*" or useragent matches "*nuclei*" or uri matches "*/.env*" or uri matches "*phpinfo*"
| count by client_ip, useragent
| where _count > 5
| if(_count > 50, "High", if(_count > 20, "Medium", "Low")) as RiskScore

medium severity low confidence

Data Sources

Sumo Logic Cloud SIEM Log Sources via Sumo Logic Collector

Required Tables

web/access iis/access

False Positives

Legitimate SEO crawlers such as Googlebot, Bingbot, or commercial crawlers (Screaming Frog, Ahrefs, Semrush) may trigger on path enumeration rules — allowlist known crawler IP ranges and User-Agent prefixes
Internal vulnerability scanners (Nessus, Qualys, Rapid7) run by the security team against web assets will generate identical patterns — exclude known scanner IP ranges via watchlist
Developer tooling such as curl, wget, or Python requests used legitimately by CI/CD pipelines or deployment scripts may match scanner User-Agent patterns — baseline known build server IPs

Google Chronicle / SecOps

yaral

rule t1592_gather_victim_host_information {
  meta:
    author = "df00tech"
    description = "Detects host fingerprinting via scanner user agents and version-probe paths"
    mitre_attack_tactic = "TA0043"
    mitre_attack_technique = "T1592"
    confidence = "low"
    severity = "medium"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      $e.network.http.user_agent = /masscan|zgrab|shodan|nuclei|nikto|nmap/i
      or $e.network.http.request_url = /\.env|\.git\/|phpinfo\.php|server-status|actuator/i
    )
  condition:
    $e
}

medium severity low confidence

Data Sources

Google Chronicle SIEM Chronicle UDM

Required Tables

NETWORK_HTTP NETWORK_CONNECTION

False Positives

Legitimate SEO crawlers such as Googlebot, Bingbot, or commercial crawlers (Screaming Frog, Ahrefs, Semrush) may trigger on path enumeration rules — allowlist known crawler IP ranges and User-Agent prefixes
Internal vulnerability scanners (Nessus, Qualys, Rapid7) run by the security team against web assets will generate identical patterns — exclude known scanner IP ranges via watchlist
Developer tooling such as curl, wget, or Python requests used legitimately by CI/CD pipelines or deployment scripts may match scanner User-Agent patterns — baseline known build server IPs

CrowdStrike LogScale (CQL)

cql

#event_simpleName = "HttpRequest"
| UserAgent = /masscan|zgrab|shodan|nuclei|nikto|nmap|whatweb|wappalyzer/i
  OR RequestUrl = /\.env|\.git\/|phpinfo\.php|server-status|actuator\/|version\.txt/i
| case {
    UserAgent = /masscan|zgrab|shodan/i => TechniqueLabel := "T1592 - KnownScanner";
    RequestUrl = /phpinfo|server-status|actuator/i => TechniqueLabel := "T1592 - VersionProbe";
    * => TechniqueLabel := "T1592 - HostFingerprint"
  }
| table([@timestamp, ComputerName, UserAgent, RequestUrl, TechniqueLabel])

medium severity low confidence

Data Sources

CrowdStrike Falcon CrowdStrike LogScale

Required Tables

HttpRequest ProcessRollup2

False Positives

Legitimate SEO crawlers such as Googlebot, Bingbot, or commercial crawlers (Screaming Frog, Ahrefs, Semrush) may trigger on path enumeration rules — allowlist known crawler IP ranges and User-Agent prefixes
Internal vulnerability scanners (Nessus, Qualys, Rapid7) run by the security team against web assets will generate identical patterns — exclude known scanner IP ranges via watchlist
Developer tooling such as curl, wget, or Python requests used legitimately by CI/CD pipelines or deployment scripts may match scanner User-Agent patterns — baseline known build server IPs

Gather Victim Host Information

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (4)

Same Tactic: Reconnaissance

Popular Detections