Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection.
Upgrade to ProDetect External Vulnerability Scanner Burst/Sweep Against Internet-Facing Assets in Elastic Security
This detection complements the general T1595.002 Vulnerability Scanning coverage with a focus on a specific behavioral signature: a single external source rapidly sweeping a high volume of distinct URIs, query parameters, or ports against internet-facing web/application assets within a short window. Rather than matching on scanner tool names or user-agent strings (which are trivially spoofed or stripped), this detection keys on rate and breadth — a burst of requests from one source IP hitting many unique paths/params/ports on a public-facing WAF, reverse proxy, or perimeter firewall in a tight time window is a strong behavioral indicator of automated vulnerability scanning regardless of tooling. Sandworm Team, APT41, and Magic Hound have all conducted large-scale internet-facing vulnerability scanning sweeps as a precursor to exploitation of public-facing applications (T1190), and this pattern is equally produced by commodity scanners, bug bounty researchers, and unauthorized red team activity. The detection is intentionally tool-agnostic and behavior-based — no CVE or vulnerability-specific payload matching is performed here since that is scan-target-dependent and better covered by WAF/IDS signature rules.
MITRE ATT&CK
- Tactic
- Reconnaissance
Elastic Detection Query
sequence by source.ip with maxspan=10m
[network where event.dataset : "waf.log" and url.path != null]
[network where event.dataset : "waf.log" and url.path != null]
until [network where false]Elastic EQL sequence detection for the external burst/sweep pattern: correlates repeated distinct-URL WAF/network events from the same source.ip within a 10-minute maxspan window. In production, pair this sequence skeleton with an Elastic transform/aggregation (unique_count on url.path >= 40, event count >= 150) since EQL sequences alone do not compute cardinality — use an Elastic detection rule of type "threshold" with a cardinality aggregation on url.path grouped by source.ip for the full behavioral match implemented in the KQL/SPL versions.
Data Sources
Required Tables
False Positives & Tuning
- Authorized vulnerability management scans from documented scanner IP ranges — maintain a scanner IP allowlist
- Search engine crawlers performing a full site crawl generate high URI uniqueness
- Approved bug bounty or pentest engagement traffic during a scoped window
- Load testing and synthetic monitoring tools generating high request volume across many endpoints
Other platforms for THREAT-Recon-ExternalVulnScannerBurstDetection
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External Burst Scan Against a Web Endpoint with ffuf
Expected signal: WAF/reverse-proxy access log entries showing 60 requests from the local test source in a short window, each with a distinct URI path (/test-path-1 through /test-path-60) and query parameter. If a firewall/CEF-normalized log pipeline is present, this appears as CommonSecurityLog entries with a shared SourceIP and high UniqueUris count within the burst window.
- Test 2Simulate Multi-Port Sweep Against a Single External-Facing Host
Expected signal: Firewall/NetFlow connection logs showing a burst of connection attempts from the source IP to 12 distinct destination ports on the target host within seconds. Sysmon Event ID 3 (Network Connection) on the target if endpoint monitoring is present.
References (5)
- https://attack.mitre.org/techniques/T1595/002/
- https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-014_Vulnerability_Scanning
- https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
- https://github.com/ffuf/ffuf
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.