Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection.
Upgrade to ProDetect External Vulnerability Scanner Burst/Sweep Against Internet-Facing Assets in Splunk
This detection complements the general T1595.002 Vulnerability Scanning coverage with a focus on a specific behavioral signature: a single external source rapidly sweeping a high volume of distinct URIs, query parameters, or ports against internet-facing web/application assets within a short window. Rather than matching on scanner tool names or user-agent strings (which are trivially spoofed or stripped), this detection keys on rate and breadth — a burst of requests from one source IP hitting many unique paths/params/ports on a public-facing WAF, reverse proxy, or perimeter firewall in a tight time window is a strong behavioral indicator of automated vulnerability scanning regardless of tooling. Sandworm Team, APT41, and Magic Hound have all conducted large-scale internet-facing vulnerability scanning sweeps as a precursor to exploitation of public-facing applications (T1190), and this pattern is equally produced by commodity scanners, bug bounty researchers, and unauthorized red team activity. The detection is intentionally tool-agnostic and behavior-based — no CVE or vulnerability-specific payload matching is performed here since that is scan-target-dependent and better covered by WAF/IDS signature rules.
MITRE ATT&CK
- Tactic
- Reconnaissance
SPL Detection Query
index=waf OR index=firewall OR index=proxy earliest=-1h
| eval uri_path=coalesce(uri_path, mvindex(split(url, "?"), 0), cs_uri_stem)
| eval src_display=coalesce(src_ip, src, clientip, c_ip)
| eval dest_port=coalesce(dest_port, cs_uri_port, 0)
| bin _time span=10m
| stats
count as request_count,
dc(uri_path) as unique_uris,
dc(dest_port) as unique_dest_ports,
dc(dest) as unique_dest_hosts,
values(status) as status_codes,
values(uri_path) as sample_uris,
min(_time) as first_seen,
max(_time) as last_seen
by src_display, _time
| where unique_uris >= 40 OR request_count >= 150
| eval duration_minutes=round((last_seen - first_seen) / 60, 1)
| eval requests_per_minute=round(request_count / (if(duration_minutes=0, 1, duration_minutes)), 1)
| table first_seen, last_seen, duration_minutes, src_display, request_count, unique_uris,
unique_dest_ports, unique_dest_hosts, requests_per_minute, status_codes, sample_uris
| sort - request_countSplunk search over WAF/firewall/proxy indexes identifying a single external source IP generating a high-volume, high-uniqueness burst of requests against distinct URI paths within a 10-minute bin — the same rate-and-breadth behavioral signature as the KQL rule, expressed against generic web-access-log field aliases so it adapts across WAF vendors (Cloudflare, AWS WAF, F5, Imperva) without requiring vendor-specific sourcetypes.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized vulnerability management scans from documented internal or contracted scanner IP ranges — maintain a scanner IP allowlist and suppress on src_display
- Search engine crawlers performing a full site crawl can generate high URI uniqueness — filter on known crawler ASNs/User-Agents
- Approved bug bounty or pentest engagement traffic during a scoped window
- Load testing and synthetic monitoring tools generating high request volume across many endpoints
- API clients with pagination or retry bugs iterating many distinct resource IDs in a short window
Other platforms for THREAT-Recon-ExternalVulnScannerBurstDetection
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External Burst Scan Against a Web Endpoint with ffuf
Expected signal: WAF/reverse-proxy access log entries showing 60 requests from the local test source in a short window, each with a distinct URI path (/test-path-1 through /test-path-60) and query parameter. If a firewall/CEF-normalized log pipeline is present, this appears as CommonSecurityLog entries with a shared SourceIP and high UniqueUris count within the burst window.
- Test 2Simulate Multi-Port Sweep Against a Single External-Facing Host
Expected signal: Firewall/NetFlow connection logs showing a burst of connection attempts from the source IP to 12 distinct destination ports on the target host within seconds. Sysmon Event ID 3 (Network Connection) on the target if endpoint monitoring is present.
References (5)
- https://attack.mitre.org/techniques/T1595/002/
- https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-014_Vulnerability_Scanning
- https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
- https://github.com/ffuf/ffuf
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.