Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DistributedVulnScanBurst.
Upgrade to ProDetect Distributed Vulnerability Scanning Burst Against Web Infrastructure in Microsoft Sentinel
Adversaries and access brokers run automated vulnerability scanners against externally-facing web infrastructure to fingerprint exposed technology and locate exploitable misconfigurations before initial access. Two patterns dominate: a concentrated burst, where a single source IP fires a wide diversity of scanner-signature requests (config file probes, admin panel paths, framework actuator endpoints, path traversal, webshell probes) at a target within minutes; and a low-and-slow variant, where a small rotating pool of source IPs within the same /24 subnet or hosting-provider ASN spreads the same signature diversity across a much longer window to stay under per-IP rate-limit thresholds. Both patterns are typically observed in WAF, reverse-proxy, or perimeter firewall logs rather than endpoint telemetry, since the target is the externally-facing HTTP surface itself. Detection prioritises the diversity of distinct scanner-signature categories touched per source (or per rotating subnet) over raw request volume, since volume alone is indistinguishable from normal crawler/bot traffic while signature diversity is not.
MITRE ATT&CK
- Tactic
- Reconnaissance
KQL Detection Query
let ScannerPathSignatures = dynamic([".env", ".git/config", ".git/HEAD", "wp-login.php", "wp-admin/setup-config.php", "xmlrpc.php", "phpmyadmin", "actuator/env", "actuator/health", "console/", "manager/html", "solr/admin", "cgi-bin/", "../../../../etc/passwd", "shell.php", "config.php.bak", "vendor/phpunit", "telescope/requests", "debug/default/view", "server-status", "eval-stdin.php"]);
let ScannerUserAgents = dynamic(["sqlmap", "Nikto", "Nessus", "Acunetix", "masscan", "zgrab", "Nuclei", "dirbuster", "gobuster", "wpscan", "OpenVAS", "Qualys"]);
// Alert 1: Concentrated burst - many distinct scanner signatures from one source IP in a short window
let Burst = CommonSecurityLog
| where TimeGenerated > ago(1h)
| where isnotempty(RequestURL)
| where RequestURL has_any (ScannerPathSignatures) or (isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents))
| extend MatchedSignature = case(
RequestURL has ".env", ".env",
RequestURL has ".git", ".git",
RequestURL has "wp-login" or RequestURL has "wp-admin", "wordpress_admin",
RequestURL has "xmlrpc.php", "xmlrpc",
RequestURL has "actuator", "spring_actuator",
RequestURL has "phpmyadmin", "phpmyadmin",
RequestURL has "solr/admin", "solr_admin",
RequestURL has "manager/html", "tomcat_manager",
RequestURL has "../../" or RequestURL has "..%2f", "path_traversal",
RequestURL has "shell.php" or RequestURL has "eval-stdin", "webshell_probe",
isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents), "scanner_useragent",
"other_scanner_signature"
)
| summarize DistinctSignatures = dcount(MatchedSignature), DistinctPaths = dcount(RequestURL), TotalRequests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Signatures = make_set(MatchedSignature), TargetHosts = make_set(DestinationHostName) by SourceIP
| where DistinctSignatures >= 6 and DistinctPaths >= 10
| extend BurstDurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| extend DetectionType = "ConcentratedBurst", RiskScore = case(DistinctSignatures >= 15, 95, DistinctSignatures >= 10, 88, 78);
// Alert 2: Low-and-slow - rotating source IPs within the same /24 spreading scanner signatures across a long window
let LowAndSlow = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where RequestURL has_any (ScannerPathSignatures) or (isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents))
| extend Subnet24 = strcat(tostring(split(SourceIP, ".")[0]), ".", tostring(split(SourceIP, ".")[1]), ".", tostring(split(SourceIP, ".")[2]), ".0/24")
| extend MatchedSignature = case(
RequestURL has ".env", ".env",
RequestURL has ".git", ".git",
RequestURL has "wp-login" or RequestURL has "wp-admin", "wordpress_admin",
RequestURL has "xmlrpc.php", "xmlrpc",
RequestURL has "actuator", "spring_actuator",
RequestURL has "phpmyadmin", "phpmyadmin",
RequestURL has "solr/admin", "solr_admin",
RequestURL has "manager/html", "tomcat_manager",
RequestURL has "../../" or RequestURL has "..%2f", "path_traversal",
RequestURL has "shell.php" or RequestURL has "eval-stdin", "webshell_probe",
isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents), "scanner_useragent",
"other_scanner_signature"
)
| summarize DistinctSignatures = dcount(MatchedSignature), DistinctSourceIPs = dcount(SourceIP), DistinctPaths = dcount(RequestURL), TotalRequests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SourceIPs = make_set(SourceIP), Signatures = make_set(MatchedSignature) by Subnet24
| where DistinctSourceIPs >= 3 and DistinctSourceIPs <= 25 and DistinctSignatures >= 8
| extend DetectionType = "LowAndSlowSubnetRotation", RiskScore = case(DistinctSignatures >= 15, 92, DistinctSignatures >= 10, 82, 72);
union Burst, LowAndSlow
| sort by RiskScore desc, DistinctSignatures descTwo-alert KQL detection over CommonSecurityLog (WAF/reverse-proxy/firewall CEF telemetry): (1) ConcentratedBurst flags a single source IP touching >=6 distinct scanner-signature categories across >=10 distinct paths within a 1-hour window; (2) LowAndSlowSubnetRotation flags 3-25 distinct source IPs within the same /24 subnet collectively touching >=8 distinct scanner-signature categories across a 24-hour window, indicating rotation to evade per-IP rate limiting. RiskScore scales with signature diversity.
Data Sources
Required Tables
False Positives & Tuning
- Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
- Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
- Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
- SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
- Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address
Other platforms for THREAT-Recon-DistributedVulnScanBurst
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Scanner Signature Path Sweep (Concentrated Burst)
Expected signal: WAF/reverse-proxy logs show >=10 distinct scanner-signature paths requested within seconds from the tester's single source IP, User-Agent 'AtomicTest-VulnScan/1.0'.
- Test 2Known Scanner Tool User-Agent Sweep
Expected signal: WAF logs show dozens of distinct paths (config, admin, CGI, backup file probes) and User-Agent containing 'Nikto' from the tester's source IP within minutes.
- Test 3Low-and-Slow Subnet-Rotated Scan Simulation
Expected signal: WAF logs show 4 distinct source IPs within 198.51.100.0/24, each issuing 2 scanner-signature requests spread across several hours, collectively covering >=8 distinct signature categories.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-DistributedVulnScanBurst — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Recon-AutomatedVulnScannerSweepAutomated Vulnerability Scanner Sweep Against External Attack Surface
- THREAT-Recon-ExternalVulnScannerBurstDetectionExternal Vulnerability Scanner Burst/Sweep Against Internet-Facing AssetsBurst/sweep rate-and-breadth angle on external, internet-facing vulnerability scanning — distinct from the tool-signature and internal-scanner-execution branches already covered on the T1595.002 technique page; this detection fires purely on request volume/uniqueness from a single external source against WAF/firewall/proxy logs, without relying on scanner tool names or user-agent strings.