Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-CloudAssetShadowITDiscovery.
Unlock with Pro - from £29/user/moDetect Cloud Asset & Shadow IT Discovery via Internet-Wide Scanning Services in IBM QRadar
Adversaries performing Search Open Technical Databases (T1596) rarely scan a target's network directly — instead they query commercial internet-wide scan-database services such as Shodan, Censys, BinaryEdge, ZoomEye, and ONYPHE, which continuously crawl the entire public IPv4/IPv6 space and index open ports, service banners, TLS certificates, and known CVEs for every internet-facing host. This lets an adversary map an organization's external attack surface — including forgotten dev/staging environments, misconfigured cloud storage endpoints, unmanaged VMs, and other 'shadow IT' the security team never inventoried — without sending a single packet the target can attribute to them. Because the adversary's actual query happens against the third-party database and is invisible to the defender, the only observable telemetry is the re-indexing traffic these scanning services' own crawler infrastructure generates as they continuously re-scan the internet to keep their databases current. This detection treats that crawler traffic as an early-warning signal: it flags (1) perimeter traffic from known scanning-service IP ranges probing many distinct ports on a single asset (the banner-grab pattern used to populate these databases), and, more importantly, (2) scanning-service traffic that reaches a destination IP absent from the organization's own asset inventory — meaning a commercial scan database has just indexed infrastructure the defender did not know was internet-facing. That second signal is functionally identical to what an adversary running T1596 would discover, giving defenders a chance to find and remediate the shadow IT asset before it is weaponized under T1190 (Exploit Public-Facing Application).
MITRE ATT&CK
- Tactic
- Reconnaissance
QRadar Detection Query
-- Alert 1: Perimeter traffic from known internet-wide scanning service ranges touching 5+ distinct destination ports on a single asset
SELECT
sourceip AS SourceIP,
destinationip AS DestinationIP,
COUNT(DISTINCT destinationport) AS DistinctPorts,
DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS FirstSeen,
DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') AS LastSeen,
COUNT(*) AS HitCount
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Firewall%'
AND ( INCIDR('198.20.69.0/24', sourceip) OR INCIDR('198.20.70.0/24', sourceip) OR INCIDR('198.20.71.0/24', sourceip)
OR INCIDR('167.94.138.0/24', sourceip) OR INCIDR('167.94.145.0/24', sourceip) OR INCIDR('167.94.146.0/24', sourceip)
OR INCIDR('162.142.125.0/24', sourceip) OR INCIDR('199.45.152.0/23', sourceip) OR INCIDR('199.45.154.0/23', sourceip)
OR INCIDR('195.154.108.0/24', sourceip) OR INCIDR('71.6.135.0/24', sourceip) OR INCIDR('64.62.202.0/24', sourceip) )
GROUP BY sourceip, destinationip
HAVING COUNT(DISTINCT destinationport) >= 5
LAST 14 DAYS
UNION ALL
-- Alert 2: Scanner-sourced traffic reaching a destination IP absent from the KnownAssets reference set
SELECT
destinationip AS DestinationIP,
COUNT(*) AS HitCount,
COUNT(DISTINCT sourceip) AS DistinctSourceScanners,
DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS FirstSeen,
DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') AS LastSeen
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Firewall%'
AND ( INCIDR('198.20.69.0/24', sourceip) OR INCIDR('167.94.138.0/24', sourceip) OR INCIDR('162.142.125.0/24', sourceip)
OR INCIDR('199.45.152.0/23', sourceip) OR INCIDR('195.154.108.0/24', sourceip) )
AND destinationip NOT IN (SELECT AssetIP FROM REFERENCE TABLE KnownAssets)
GROUP BY destinationip
LAST 14 DAYS
ORDER BY LastSeen DESCTwo AQL queries unioned for T1596 crawler-traffic detection. The first matches known internet-wide scanning-service source ranges probing 5 or more distinct destination ports on a single asset within a firewall data source. The second checks scanner-sourced destination IPs against a QRadar reference table (KnownAssets) populated from your asset inventory, surfacing any destination not present in that reference set — the shadow-asset signal. Requires a firewall log source and a maintained KnownAssets reference table/set.
Data Sources
Required Tables
False Positives & Tuning
- Authorized red team or third-party pentest infrastructure overlapping with commercial internet-scanning IP ranges
- Uptime/monitoring SaaS providers probing multiple ports for health checks from ranges not yet allowlisted
- Newly provisioned intentionally public-facing assets not yet added to the KnownAssets reference table
Other platforms for THREAT-Recon-CloudAssetShadowITDiscovery
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Linux — Multi-Port TCP Connect Sweep Simulating Scanner Breadth Probe
Expected signal: Perimeter firewall/NSG flow log entries (CommonSecurityLog or CEF equivalent) recording 15-20 distinct DestinationPort values from the test source IP to <TARGET_IP> within a short window, with an allow or deny verdict per port.
- Test 2Linux — HTTP Request Using Known Scan-Database Crawler User-Agent
Expected signal: Web/application server access log entry for <TEST_WEB_HOST> recording the User-Agent string 'CensysInspect/1.1 (+https://about.censys.io/)' against the source IP that issued the request.
- Test 3Linux — Scanner Traffic Reaching an Asset Absent From the KnownAssets Watchlist
Expected signal: Perimeter firewall/flow log entries for the test source IP reaching <SHADOW_TEST_IP> on the probed ports, with no corresponding entry for <SHADOW_TEST_IP> in the KnownAssets watchlist or known_assets.csv lookup.
References (8)
- https://attack.mitre.org/techniques/T1596/
- https://attack.mitre.org/techniques/T1596/005/
- https://www.shodan.io/
- https://censys.io/
- https://about.censys.io/
- https://www.rapid7.com/research/project-sonar/
- https://viz.greynoise.io/
- https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-network
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-CloudAssetShadowITDiscovery — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month