Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-AutomatedVulnScannerSweep.
Upgrade to ProAutomated Vulnerability Scanner Sweep Against External Attack Surface
Before exploitation, most intrusions begin with active scanning of the target's external attack surface using automated vulnerability scanning tools such as sqlmap, Nikto, Nuclei, Acunetix, Nessus, OpenVAS, or WPScan. Attackers run these tools against internet-facing web applications, APIs, and edge devices to fingerprint software versions, enumerate misconfigurations, and identify exploitable CVEs before committing to an intrusion attempt. This scanning is typically noisy at the HTTP layer: high-volume requests for known vulnerable paths (e.g. /.env, /.git/config, /wp-login.php, /actuator/health, /phpmyadmin), distinctive scanner user-agent strings, and rapid sequential probing of many distinct URIs from a single source in a short window. Nation-state actors such as Volt Typhoon and APT41 routinely scan edge devices and web infrastructure ahead of exploitation attempts, while eCrime groups like FIN7 and Scattered Spider use commodity scanning frameworks to identify soft targets at scale. Detecting the scanning phase gives defenders a window to harden or patch before the attacker moves to Initial Access.
What is THREAT-Recon-AutomatedVulnScannerSweep Automated Vulnerability Scanner Sweep Against External Attack Surface?
Automated Vulnerability Scanner Sweep Against External Attack Surface (THREAT-Recon-AutomatedVulnScannerSweep) maps to the Reconnaissance tactic — the adversary is trying to gather information they can use to plan future operations in MITRE ATT&CK.
This page provides production-ready detection logic for Automated Vulnerability Scanner Sweep Against External Attack Surface, covering the data sources and telemetry it touches: CommonSecurityLog (CEF from WAF/reverse-proxy appliances), F5 ASM, Imperva, FortiWeb, Akamai Kona, Cloudflare, Citrix NetScaler AppFirewall logs, Syslog (native web server/reverse-proxy access logs). The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Reconnaissance
// THREAT: Automated Vulnerability Scanner Sweep
// Detects known scanner tool signatures and behavioral URI-enumeration sweeps against WAF/reverse-proxy protected web infrastructure
// Sources: CommonSecurityLog (CEF from WAF/reverse-proxy appliances: F5 ASM, Imperva, FortiWeb, Akamai, Cloudflare, Citrix NetScaler)
// Alert 1: Known vulnerability scanner tool signature observed in request
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has_any ("F5", "Imperva", "Fortinet", "Akamai", "Cloudflare", "Citrix", "Barracuda", "Palo Alto")
| where DeviceProduct has_any ("ASM", "WAF", "FortiWeb", "Kona", "NetScaler", "Web Application Firewall")
| where Message has_any ("sqlmap", "nikto", "nuclei", "acunetix", "nessus", "openvas", "w3af", "dirbuster", "gobuster", "wpscan", "zgrab", "masscan", "nmap scripting engine")
or RequestURL has_any ("/.env", "/.git/config", "/.git/HEAD", "/wp-login.php", "/actuator/env", "/actuator/health", "/phpmyadmin", "/.aws/credentials", "/server-status", "/xmlrpc.php")
| extend ThreatType = "AutomatedVulnScannerSweep_KnownSignature"
| extend Severity = "Medium"
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, DeviceVendor, DeviceProduct, Message, ThreatType, Severity
| sort by TimeGenerated desc;
// Alert 2: Behavioral sweep — single source IP enumerating many distinct URIs with high error rate in a short window
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has_any ("F5", "Imperva", "Fortinet", "Akamai", "Cloudflare", "Citrix", "Barracuda", "Palo Alto")
| where DeviceProduct has_any ("ASM", "WAF", "FortiWeb", "Kona", "NetScaler", "Web Application Firewall")
| summarize
DistinctURIs=dcount(RequestURL),
TotalRequests=count(),
NotFoundCount=countif(DeviceCustomNumber1 == 404 or Message has "404"),
SampleURIs=make_set(RequestURL, 20)
by SourceIP, DestinationIP, bin(TimeGenerated, 5m)
| where DistinctURIs >= 25 and TotalRequests >= 30
| extend NotFoundRatio = todouble(NotFoundCount) / TotalRequests
| where NotFoundRatio >= 0.5
| extend ThreatType = "AutomatedVulnScannerSweep_BehavioralEnumeration"
| extend Severity = iff(DistinctURIs >= 100, "High", "Medium")
| sort by DistinctURIs descTwo-stage vulnerability scanner detection: (1) known scanner tool signatures (sqlmap, Nikto, Nuclei, etc.) or requests for well-known vulnerable/sensitive paths observed in WAF/reverse-proxy logs; (2) behavioral detection of a single source IP rapidly enumerating 25+ distinct URIs with a majority-404 response pattern within a 5-minute window, which catches custom or unsigned scanning tools that Alert 1's signature match would miss.
Data Sources
Required Tables
False Positives
- Authorised vulnerability management scans (Nessus, Qualys, internal red team) not excluded from the detection's source-IP allowlist
- Third-party uptime/synthetic monitoring services probing multiple health-check endpoints from a shared IP
- Search engine crawlers or SEO audit tools generating high request volume with some 404s for stale sitemap links
- Web application vulnerability scanning conducted by the organisation's own AppSec team ahead of a release
Sigma rule & cross-platform mapping
The detection logic for Automated Vulnerability Scanner Sweep Against External Attack Surface (THREAT-Recon-AutomatedVulnScannerSweep) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: network_connection
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for THREAT-Recon-AutomatedVulnScannerSweep
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Vulnerability Scanner User-Agent Simulation via curl
Expected signal: WAF/reverse-proxy logs record inbound requests with the scanner user-agent strings in the Message or http_user_agent field.
- Test 2Sensitive Path Probing Simulation
Expected signal: WAF/reverse-proxy logs show requests to each sensitive path, mostly resulting in 404 responses.
- Test 3Behavioral URI Enumeration Simulation via ffuf-style Loop
Expected signal: WAF/reverse-proxy logs record 40 distinct URIs requested from the test source IP within a single 5-minute window, nearly all returning 404.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-AutomatedVulnScannerSweep — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Recon-DistributedVulnScanBurstDistributed Vulnerability Scanning Burst Against Web Infrastructure
- THREAT-Recon-ExternalVulnScannerBurstDetectionExternal Vulnerability Scanner Burst/Sweep Against Internet-Facing AssetsBurst/sweep rate-and-breadth angle on external, internet-facing vulnerability scanning — distinct from the tool-signature and internal-scanner-execution branches already covered on the T1595.002 technique page; this detection fires purely on request volume/uniqueness from a single external source against WAF/firewall/proxy logs, without relying on scanner tool names or user-agent strings.