Which SIEM platforms have a THREAT-Recon-DistributedVulnScanBurst detection rule?

df00tech provides THREAT-Recon-DistributedVulnScanBurst (Distributed Vulnerability Scanning Burst Against Web Infrastructure) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-Recon-DistributedVulnScanBurst detection?

The THREAT-Recon-DistributedVulnScanBurst detection is rated high severity with medium confidence.

What are common false positives for THREAT-Recon-DistributedVulnScanBurst?

Common false positives for THREAT-Recon-DistributedVulnScanBurst include: Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule; Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window; Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs.

Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DistributedVulnScanBurst.

Upgrade to Pro

THREAT-Recon-DistributedVulnScanBurst IBM QRadar · QRadar

Detect Distributed Vulnerability Scanning Burst Against Web Infrastructure in IBM QRadar

Q: What data sources are required to detect Distributed Vulnerability Scanning Burst Against Web Infrastructure (THREAT-Recon-DistributedVulnScanBurst)?

Detecting Distributed Vulnerability Scanning Burst Against Web Infrastructure requires the following data sources: WAF logs forwarded as CEF (F5 ASM, Imperva, Fortinet FortiWeb, Palo Alto), Azure Application Gateway / Front Door WAF logs, Reverse proxy / perimeter firewall access logs.

Adversaries and access brokers run automated vulnerability scanners against externally-facing web infrastructure to fingerprint exposed technology and locate exploitable misconfigurations before initial access. Two patterns dominate: a concentrated burst, where a single source IP fires a wide diversity of scanner-signature requests (config file probes, admin panel paths, framework actuator endpoints, path traversal, webshell probes) at a target within minutes; and a low-and-slow variant, where a small rotating pool of source IPs within the same /24 subnet or hosting-provider ASN spreads the same signature diversity across a much longer window to stay under per-IP rate-limit thresholds. Both patterns are typically observed in WAF, reverse-proxy, or perimeter firewall logs rather than endpoint telemetry, since the target is the externally-facing HTTP surface itself. Detection prioritises the diversity of distinct scanner-signature categories touched per source (or per rotating subnet) over raw request volume, since volume alone is indistinguishable from normal crawler/bot traffic while signature diversity is not.

MITRE ATT&CK

Tactic: Reconnaissance

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  "URL" AS RequestPath,
  "User Agent" AS UserAgent,
  UNIQUECOUNT("URL") AS DistinctPaths,
  CASE
    WHEN "URL" ILIKE '%.env%' THEN '.env'
    WHEN "URL" ILIKE '%.git%' THEN '.git'
    WHEN "URL" ILIKE '%wp-login%' OR "URL" ILIKE '%wp-admin%' THEN 'wordpress_admin'
    WHEN "URL" ILIKE '%xmlrpc.php%' THEN 'xmlrpc'
    WHEN "URL" ILIKE '%actuator%' THEN 'spring_actuator'
    WHEN "URL" ILIKE '%phpmyadmin%' THEN 'phpmyadmin'
    WHEN "URL" ILIKE '%solr/admin%' THEN 'solr_admin'
    WHEN "URL" ILIKE '%manager/html%' THEN 'tomcat_manager'
    WHEN "URL" ILIKE '%../../%' THEN 'path_traversal'
    WHEN "URL" ILIKE '%shell.php%' OR "URL" ILIKE '%eval-stdin%' THEN 'webshell_probe'
    WHEN "User Agent" ILIKE '%sqlmap%' OR "User Agent" ILIKE '%Nikto%' OR "User Agent" ILIKE '%Nessus%' OR "User Agent" ILIKE '%Acunetix%' OR "User Agent" ILIKE '%masscan%' OR "User Agent" ILIKE '%zgrab%' OR "User Agent" ILIKE '%Nuclei%' OR "User Agent" ILIKE '%wpscan%' THEN 'scanner_useragent'
    ELSE 'other_scanner_signature'
  END AS MatchedSignature
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (66, 4, 250)
  AND starttime > NOW() - 86400000
  AND (
    "URL" ILIKE '%.env%' OR "URL" ILIKE '%.git%' OR "URL" ILIKE '%wp-login%' OR "URL" ILIKE '%wp-admin%'
    OR "URL" ILIKE '%xmlrpc.php%' OR "URL" ILIKE '%actuator%' OR "URL" ILIKE '%phpmyadmin%'
    OR "URL" ILIKE '%solr/admin%' OR "URL" ILIKE '%manager/html%' OR "URL" ILIKE '%../../%'
    OR "URL" ILIKE '%shell.php%' OR "URL" ILIKE '%eval-stdin%'
    OR "User Agent" ILIKE '%sqlmap%' OR "User Agent" ILIKE '%Nikto%' OR "User Agent" ILIKE '%Nessus%'
    OR "User Agent" ILIKE '%Acunetix%' OR "User Agent" ILIKE '%masscan%' OR "User Agent" ILIKE '%zgrab%'
    OR "User Agent" ILIKE '%Nuclei%' OR "User Agent" ILIKE '%wpscan%'
  )
GROUP BY SourceIP
HAVING UNIQUECOUNT("URL") >= 8
ORDER BY DistinctPaths DESC

high severity medium confidence

AQL query for IBM QRadar aggregating scanner-signature path matches per source IP over a 24-hour window, flagging source IPs that touch >=8 distinct URL paths matching known scanner signatures.

Data Sources

IBM QRadar SIEMWAF/reverse-proxy log sources (DSMs for F5, Fortinet, Imperva)

Required Tables

events

False Positives & Tuning

Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address

Other platforms for THREAT-Recon-DistributedVulnScanBurst

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Scanner Signature Path Sweep (Concentrated Burst)
Expected signal: WAF/reverse-proxy logs show >=10 distinct scanner-signature paths requested within seconds from the tester's single source IP, User-Agent 'AtomicTest-VulnScan/1.0'.
Test 2Known Scanner Tool User-Agent Sweep
Expected signal: WAF logs show dozens of distinct paths (config, admin, CGI, backup file probes) and User-Agent containing 'Nikto' from the tester's source IP within minutes.
Test 3Low-and-Slow Subnet-Rotated Scan Simulation
Expected signal: WAF logs show 4 distinct source IPs within 198.51.100.0/24, each issuing 2 scanner-signature requests spread across several hours, collectively covering >=8 distinct signature categories.

Last updated: 2026-07-20 Research depth: deep

References (5)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock playbooks & atomic tests with Pro

Get the full detection package for THREAT-Recon-DistributedVulnScanBurst — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Tactic Hub

TA0043Reconnaissance

Detection Variants (2)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1595.002Vulnerability Scanning

Related Techniques

T1595.001Scanning IP Blocks T1590Gather Victim Network Information T1592Gather Victim Host Information T1190Exploit Public-Facing Application T1189Drive-by Compromise

Detect Distributed Vulnerability Scanning Burst Against Web Infrastructure in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for THREAT-Recon-DistributedVulnScanBurst

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (2)

Parent Technique

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for THREAT-Recon-DistributedVulnScanBurst

Testing Methodology

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (2)

Parent Technique

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

Get new detections in your inbox