Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection.
Upgrade to ProDetect External Vulnerability Scanner Burst/Sweep Against Internet-Facing Assets in Google Chronicle
This detection complements the general T1595.002 Vulnerability Scanning coverage with a focus on a specific behavioral signature: a single external source rapidly sweeping a high volume of distinct URIs, query parameters, or ports against internet-facing web/application assets within a short window. Rather than matching on scanner tool names or user-agent strings (which are trivially spoofed or stripped), this detection keys on rate and breadth — a burst of requests from one source IP hitting many unique paths/params/ports on a public-facing WAF, reverse proxy, or perimeter firewall in a tight time window is a strong behavioral indicator of automated vulnerability scanning regardless of tooling. Sandworm Team, APT41, and Magic Hound have all conducted large-scale internet-facing vulnerability scanning sweeps as a precursor to exploitation of public-facing applications (T1190), and this pattern is equally produced by commodity scanners, bug bounty researchers, and unauthorized red team activity. The detection is intentionally tool-agnostic and behavior-based — no CVE or vulnerability-specific payload matching is performed here since that is scan-target-dependent and better covered by WAF/IDS signature rules.
MITRE ATT&CK
- Tactic
- Reconnaissance
YARA-L Detection Query
rule external_vuln_scanner_burst {
meta:
author = "df00tech"
description = "Detects external burst/sweep vulnerability scanning against internet-facing assets"
severity = "MEDIUM"
mitre_attack_tactic = "Reconnaissance"
mitre_attack_technique = "T1595.002"
reference = "https://attack.mitre.org/techniques/T1595/002/"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.target.url != ""
$e.principal.ip = $src_ip
match:
$src_ip over 10m
outcome:
$request_count = count($e.metadata.id)
$unique_uris = count_distinct($e.target.url)
condition:
$e and $unique_uris >= 40
}Chronicle YARA-L 2.0 rule matching NETWORK_HTTP UDM events, grouping by source IP over a 10-minute window and computing request count and unique target.url cardinality — flags sources whose distinct-URL count meets the burst threshold, mirroring the KQL/SPL rate-and-breadth logic in Chronicle's native aggregation syntax.
Data Sources
Required Tables
False Positives & Tuning
- Authorized vulnerability management scans from documented scanner IP ranges
- Search engine crawlers generating high URI uniqueness during a full site crawl
- Approved bug bounty or pentest engagement traffic
Other platforms for THREAT-Recon-ExternalVulnScannerBurstDetection
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External Burst Scan Against a Web Endpoint with ffuf
Expected signal: WAF/reverse-proxy access log entries showing 60 requests from the local test source in a short window, each with a distinct URI path (/test-path-1 through /test-path-60) and query parameter. If a firewall/CEF-normalized log pipeline is present, this appears as CommonSecurityLog entries with a shared SourceIP and high UniqueUris count within the burst window.
- Test 2Simulate Multi-Port Sweep Against a Single External-Facing Host
Expected signal: Firewall/NetFlow connection logs showing a burst of connection attempts from the source IP to 12 distinct destination ports on the target host within seconds. Sysmon Event ID 3 (Network Connection) on the target if endpoint monitoring is present.
References (5)
- https://attack.mitre.org/techniques/T1595/002/
- https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-014_Vulnerability_Scanning
- https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
- https://github.com/ffuf/ffuf
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.