Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-AutomatedVulnScannerSweep.
Upgrade to ProDetect Automated Vulnerability Scanner Sweep Against External Attack Surface in Splunk
Before exploitation, most intrusions begin with active scanning of the target's external attack surface using automated vulnerability scanning tools such as sqlmap, Nikto, Nuclei, Acunetix, Nessus, OpenVAS, or WPScan. Attackers run these tools against internet-facing web applications, APIs, and edge devices to fingerprint software versions, enumerate misconfigurations, and identify exploitable CVEs before committing to an intrusion attempt. This scanning is typically noisy at the HTTP layer: high-volume requests for known vulnerable paths (e.g. /.env, /.git/config, /wp-login.php, /actuator/health, /phpmyadmin), distinctive scanner user-agent strings, and rapid sequential probing of many distinct URIs from a single source in a short window. Nation-state actors such as Volt Typhoon and APT41 routinely scan edge devices and web infrastructure ahead of exploitation attempts, while eCrime groups like FIN7 and Scattered Spider use commodity scanning frameworks to identify soft targets at scale. Detecting the scanning phase gives defenders a window to harden or patch before the attacker moves to Initial Access.
MITRE ATT&CK
- Tactic
- Reconnaissance
SPL Detection Query
index=network sourcetype IN ("f5:asm", "imperva:waf", "fortinet:fortiweb", "akamai:kona", "cloudflare:waf", "citrix:netscaler")
(
match(http_user_agent, "(?i)(sqlmap|nikto|nuclei|acunetix|nessus|openvas|w3af|dirbuster|gobuster|wpscan|zgrab|masscan)")
OR uri_path IN ("/.env", "/.git/config", "/.git/HEAD", "/wp-login.php", "/actuator/env", "/actuator/health", "/phpmyadmin", "/.aws/credentials", "/server-status", "/xmlrpc.php")
)
| eval ThreatType="AutomatedVulnScannerSweep_KnownSignature"
| eval Severity="MEDIUM"
| table _time, src_ip, dest_ip, uri_path, http_user_agent, ThreatType, Severity
| sort - _time
| appendpipe [
search index=network sourcetype IN ("f5:asm", "imperva:waf", "fortinet:fortiweb", "akamai:kona", "cloudflare:waf", "citrix:netscaler")
| bin _time span=5m
| stats
dc(uri_path) AS DistinctURIs,
count AS TotalRequests,
count(eval(status=404)) AS NotFoundCount,
values(uri_path) AS SampleURIs
BY src_ip, dest_ip, _time
| where DistinctURIs >= 25 AND TotalRequests >= 30
| eval NotFoundRatio=round(NotFoundCount/TotalRequests, 2)
| where NotFoundRatio >= 0.5
| eval ThreatType="AutomatedVulnScannerSweep_BehavioralEnumeration"
| eval Severity=case(DistinctURIs >= 100, "HIGH", true(), "MEDIUM")
| sort - DistinctURIs
]SPL detection combining known vulnerability scanner signatures (user-agent and sensitive-path matching) with a behavioral fallback that flags a single source IP enumerating 25+ distinct URIs with a majority-404 response ratio in a 5-minute window across WAF/reverse-proxy log sourcetypes.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorised internal or third-party vulnerability scanning not yet added to the source-IP exclusion list
- Synthetic monitoring or uptime-check services hitting many health-check endpoints from one IP
- Broken sitemap links causing legitimate search engine crawlers to generate a burst of 404s
- AppSec team pre-release scanning of the same web application
Other platforms for THREAT-Recon-AutomatedVulnScannerSweep
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Vulnerability Scanner User-Agent Simulation via curl
Expected signal: WAF/reverse-proxy logs record inbound requests with the scanner user-agent strings in the Message or http_user_agent field.
- Test 2Sensitive Path Probing Simulation
Expected signal: WAF/reverse-proxy logs show requests to each sensitive path, mostly resulting in 404 responses.
- Test 3Behavioral URI Enumeration Simulation via ffuf-style Loop
Expected signal: WAF/reverse-proxy logs record 40 distinct URIs requested from the test source IP within a single 5-minute window, nearly all returning 404.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-AutomatedVulnScannerSweep — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Recon-DistributedVulnScanBurstDistributed Vulnerability Scanning Burst Against Web Infrastructure
- THREAT-Recon-ExternalVulnScannerBurstDetectionExternal Vulnerability Scanner Burst/Sweep Against Internet-Facing AssetsBurst/sweep rate-and-breadth angle on external, internet-facing vulnerability scanning — distinct from the tool-signature and internal-scanner-execution branches already covered on the T1595.002 technique page; this detection fires purely on request volume/uniqueness from a single external source against WAF/firewall/proxy logs, without relying on scanner tool names or user-agent strings.