Detect Cloud Asset & Shadow IT Discovery via Internet-Wide Scanning Services in Elastic Security

Adversaries performing Search Open Technical Databases (T1596) rarely scan a target's network directly — instead they query commercial internet-wide scan-database services such as Shodan, Censys, BinaryEdge, ZoomEye, and ONYPHE, which continuously crawl the entire public IPv4/IPv6 space and index open ports, service banners, TLS certificates, and known CVEs for every internet-facing host. This lets an adversary map an organization's external attack surface — including forgotten dev/staging environments, misconfigured cloud storage endpoints, unmanaged VMs, and other 'shadow IT' the security team never inventoried — without sending a single packet the target can attribute to them. Because the adversary's actual query happens against the third-party database and is invisible to the defender, the only observable telemetry is the re-indexing traffic these scanning services' own crawler infrastructure generates as they continuously re-scan the internet to keep their databases current. This detection treats that crawler traffic as an early-warning signal: it flags (1) perimeter traffic from known scanning-service IP ranges probing many distinct ports on a single asset (the banner-grab pattern used to populate these databases), and, more importantly, (2) scanning-service traffic that reaches a destination IP absent from the organization's own asset inventory — meaning a commercial scan database has just indexed infrastructure the defender did not know was internet-facing. That second signal is functionally identical to what an adversary running T1596 would discover, giving defenders a chance to find and remediate the shadow IT asset before it is weaponized under T1190 (Exploit Public-Facing Application).