Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-CloudAssetShadowITDiscovery.
Unlock with Pro - from £29/user/moSearch Open Technical Databases — Cloud Asset & Shadow IT Discovery via Internet-Wide Scanning Services
Adversaries performing Search Open Technical Databases (T1596) rarely scan a target's network directly — instead they query commercial internet-wide scan-database services such as Shodan, Censys, BinaryEdge, ZoomEye, and ONYPHE, which continuously crawl the entire public IPv4/IPv6 space and index open ports, service banners, TLS certificates, and known CVEs for every internet-facing host. This lets an adversary map an organization's external attack surface — including forgotten dev/staging environments, misconfigured cloud storage endpoints, unmanaged VMs, and other 'shadow IT' the security team never inventoried — without sending a single packet the target can attribute to them. Because the adversary's actual query happens against the third-party database and is invisible to the defender, the only observable telemetry is the re-indexing traffic these scanning services' own crawler infrastructure generates as they continuously re-scan the internet to keep their databases current. This detection treats that crawler traffic as an early-warning signal: it flags (1) perimeter traffic from known scanning-service IP ranges probing many distinct ports on a single asset (the banner-grab pattern used to populate these databases), and, more importantly, (2) scanning-service traffic that reaches a destination IP absent from the organization's own asset inventory — meaning a commercial scan database has just indexed infrastructure the defender did not know was internet-facing. That second signal is functionally identical to what an adversary running T1596 would discover, giving defenders a chance to find and remediate the shadow IT asset before it is weaponized under T1190 (Exploit Public-Facing Application).
What is THREAT-Recon-CloudAssetShadowITDiscovery Cloud Asset & Shadow IT Discovery via Internet-Wide Scanning Services?
Cloud Asset & Shadow IT Discovery via Internet-Wide Scanning Services (THREAT-Recon-CloudAssetShadowITDiscovery) is a sub-technique of Search Open Technical Databases (T1596) in the MITRE ATT&CK framework. It maps to the Reconnaissance tactic — the adversary is trying to gather information they can use to plan future operations.
This page provides production-ready detection logic for Cloud Asset & Shadow IT Discovery via Internet-Wide Scanning Services, covering the data sources and telemetry it touches: Network Traffic: Network Traffic Flow, Network Traffic: Network Connection Creation, Firewall: Firewall Traffic. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Reconnaissance
let ScannerRanges = dynamic(["198.20.69.0/24", "198.20.70.0/24", "198.20.71.0/24", "167.94.138.0/24", "167.94.145.0/24", "167.94.146.0/24", "162.142.125.0/24", "199.45.152.0/23", "199.45.154.0/23", "195.154.108.0/24", "71.6.135.0/24", "64.62.202.0/24"]);
let ScannerBreadthProbe = CommonSecurityLog
| where TimeGenerated > ago(14d)
| where isnotempty(SourceIP) and isnotempty(DestinationIP)
| where ipv4_is_in_any_range(SourceIP, ScannerRanges)
| summarize DistinctPorts = dcount(DestinationPort), Ports = make_set(DestinationPort, 25), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), HitCount = count() by SourceIP, DestinationIP, DeviceVendor, DeviceProduct
| where DistinctPorts >= 5
| extend DetectionType = "ScannerBreadthProbe"
| project TimeGenerated = LastSeen, SourceIP, DestinationIP, DeviceVendor, DeviceProduct, DistinctPorts, Ports, FirstSeen, HitCount, DetectionType;
// Alert 2: Known scanning-service traffic reaches a destination IP absent from the maintained asset-inventory watchlist — the scanner just indexed unmanaged/shadow infrastructure
let KnownAssets = _GetWatchlist('KnownAssets') | project AssetIP = tostring(IPAddress);
let ShadowAssetDiscoveredByScanner = CommonSecurityLog
| where TimeGenerated > ago(14d)
| where isnotempty(SourceIP) and isnotempty(DestinationIP)
| where ipv4_is_in_any_range(SourceIP, ScannerRanges)
| join kind=leftanti (KnownAssets) on $left.DestinationIP == $right.AssetIP
| summarize HitCount = count(), DistinctSourceScanners = dcount(SourceIP), Ports = make_set(DestinationPort, 25), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DestinationIP
| extend DetectionType = "ShadowAssetDiscoveredByScanner"
| project TimeGenerated = LastSeen, DestinationIP, HitCount, DistinctSourceScanners, Ports, FirstSeen, DetectionType;
union ScannerBreadthProbe, ShadowAssetDiscoveredByScanner
| sort by TimeGenerated descDetects T1596 crawler activity against perimeter firewall telemetry (CommonSecurityLog). Alert 1 flags known internet-wide scanning-service source ranges (Shodan, Censys, BinaryEdge, Rapid7 Project Sonar) probing 5 or more distinct destination ports on a single asset within the lookback window — the automated banner-grab pattern these services use to populate their databases. Alert 2 anti-joins the same scanner-sourced traffic against a maintained KnownAssets watchlist and surfaces any destination IP the scanner reached that is not present in that inventory, which is the strongest available signal of unmanaged/shadow IT being discovered by a public scan database.
Data Sources
Required Tables
False Positives
- Legitimate security research/vulnerability scanning conducted by your own red team or an authorized third-party pentest firm using infrastructure that happens to overlap with commercial internet-scanning IP ranges
- Uptime/monitoring SaaS providers (Pingdom, UptimeRobot, StatusCake) probing multiple ports for health-check purposes from IP ranges not yet added to an allowlist
- Customers or partners running their own Shodan/Censys queries against publicly documented, intentionally-exposed API endpoints as part of vendor due diligence
- A newly provisioned, intentionally public-facing asset that has not yet been added to the KnownAssets watchlist, briefly triggering ShadowAssetDiscoveredByScanner until inventory is updated
Sigma rule & cross-platform mapping
The detection logic for Cloud Asset & Shadow IT Discovery via Internet-Wide Scanning Services (THREAT-Recon-CloudAssetShadowITDiscovery) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: network_connection
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for THREAT-Recon-CloudAssetShadowITDiscovery
References (8)
- https://attack.mitre.org/techniques/T1596/
- https://attack.mitre.org/techniques/T1596/005/
- https://www.shodan.io/
- https://censys.io/
- https://about.censys.io/
- https://www.rapid7.com/research/project-sonar/
- https://viz.greynoise.io/
- https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-network
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Linux — Multi-Port TCP Connect Sweep Simulating Scanner Breadth Probe
Expected signal: Perimeter firewall/NSG flow log entries (CommonSecurityLog or CEF equivalent) recording 15-20 distinct DestinationPort values from the test source IP to <TARGET_IP> within a short window, with an allow or deny verdict per port.
- Test 2Linux — HTTP Request Using Known Scan-Database Crawler User-Agent
Expected signal: Web/application server access log entry for <TEST_WEB_HOST> recording the User-Agent string 'CensysInspect/1.1 (+https://about.censys.io/)' against the source IP that issued the request.
- Test 3Linux — Scanner Traffic Reaching an Asset Absent From the KnownAssets Watchlist
Expected signal: Perimeter firewall/flow log entries for the test source IP reaching <SHADOW_TEST_IP> on the probed ports, with no corresponding entry for <SHADOW_TEST_IP> in the KnownAssets watchlist or known_assets.csv lookup.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-CloudAssetShadowITDiscovery — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month