Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection.
Upgrade to ProDetect External Vulnerability Scanner Burst/Sweep Against Internet-Facing Assets in Microsoft Sentinel
This detection complements the general T1595.002 Vulnerability Scanning coverage with a focus on a specific behavioral signature: a single external source rapidly sweeping a high volume of distinct URIs, query parameters, or ports against internet-facing web/application assets within a short window. Rather than matching on scanner tool names or user-agent strings (which are trivially spoofed or stripped), this detection keys on rate and breadth — a burst of requests from one source IP hitting many unique paths/params/ports on a public-facing WAF, reverse proxy, or perimeter firewall in a tight time window is a strong behavioral indicator of automated vulnerability scanning regardless of tooling. Sandworm Team, APT41, and Magic Hound have all conducted large-scale internet-facing vulnerability scanning sweeps as a precursor to exploitation of public-facing applications (T1190), and this pattern is equally produced by commodity scanners, bug bounty researchers, and unauthorized red team activity. The detection is intentionally tool-agnostic and behavior-based — no CVE or vulnerability-specific payload matching is performed here since that is scan-target-dependent and better covered by WAF/IDS signature rules.
MITRE ATT&CK
- Tactic
- Reconnaissance
KQL Detection Query
// THREAT-Recon-ExternalVulnScannerBurstDetection
// External source sweeping many unique URIs/params/ports against internet-facing assets in a short window
let Lookback = 1h;
let UniqueUriThreshold = 40;
let RequestCountThreshold = 150;
let BurstWindowMinutes = 10;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceAction !in ("allow") or isnotempty(RequestURL)
| where isnotempty(SourceIP) and isnotempty(RequestURL)
| extend UriPath = tostring(split(RequestURL, "?")[0])
| extend QueryParams = tostring(split(RequestURL, "?")[1])
| summarize
RequestCount = count(),
UniqueUris = dcount(UriPath),
UniqueParams = dcount(QueryParams),
UniqueDestPorts = dcount(DestinationPort),
UniqueDestHosts = dcount(DestinationHostName),
StatusCodes = make_set(tostring(DeviceCustomNumber1), 10),
SampleUris = make_set(UriPath, 15),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SourceIP, bin(TimeGenerated, BurstWindowMinutes * 1m)
| where UniqueUris >= UniqueUriThreshold or RequestCount >= RequestCountThreshold
| extend DurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| extend RequestsPerMinute = round(RequestCount * 1.0 / iff(DurationMinutes == 0, 1, DurationMinutes), 1)
| project FirstSeen, LastSeen, DurationMinutes, SourceIP, RequestCount, UniqueUris, UniqueParams,
UniqueDestPorts, UniqueDestHosts, RequestsPerMinute, StatusCodes, SampleUris
| sort by RequestCount descDetects a single external source IP sweeping a high number of unique URIs/query parameters against internet-facing assets within a 10-minute burst window, using CommonSecurityLog (CEF-normalized WAF/firewall/proxy events). Fires purely on request volume and path uniqueness — no tool signature or user-agent matching required — so it catches scanners configured to evade signature-based detection. Requires perimeter WAF, reverse proxy, or firewall logs normalized into CommonSecurityLog with RequestURL and DestinationPort populated.
Data Sources
Required Tables
False Positives & Tuning
- Authorized vulnerability management scans (Nessus, Qualys, Tenable, Rapid7 InsightVM) from documented internal or contracted scanner IP ranges — maintain a scanner IP allowlist and suppress on SourceIP
- Search engine crawlers and legitimate bots (Googlebot, Bingbot) can generate high-uniqueness URI patterns during a full site crawl — filter on known crawler IP ranges/ASNs and well-formed robots.txt-compliant User-Agents
- Approved bug bounty program researchers or contracted penetration testers actively enumerating the application surface during a scoped engagement window
- Load testing or synthetic monitoring tools (e.g., k6, Gatling, Pingdom, Datadog Synthetics) generating high request volume against many endpoints from a known source
- API clients or SDKs with pagination bugs that retry many distinct resource IDs in a short window, resembling breadth-based scanning without malicious intent
Other platforms for THREAT-Recon-ExternalVulnScannerBurstDetection
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External Burst Scan Against a Web Endpoint with ffuf
Expected signal: WAF/reverse-proxy access log entries showing 60 requests from the local test source in a short window, each with a distinct URI path (/test-path-1 through /test-path-60) and query parameter. If a firewall/CEF-normalized log pipeline is present, this appears as CommonSecurityLog entries with a shared SourceIP and high UniqueUris count within the burst window.
- Test 2Simulate Multi-Port Sweep Against a Single External-Facing Host
Expected signal: Firewall/NetFlow connection logs showing a burst of connection attempts from the source IP to 12 distinct destination ports on the target host within seconds. Sysmon Event ID 3 (Network Connection) on the target if endpoint monitoring is present.
References (5)
- https://attack.mitre.org/techniques/T1595/002/
- https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-014_Vulnerability_Scanning
- https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
- https://github.com/ffuf/ffuf
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.