Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection.
Upgrade to ProDetect External Vulnerability Scanner Burst/Sweep Against Internet-Facing Assets in Sumo Logic CSE
This detection complements the general T1595.002 Vulnerability Scanning coverage with a focus on a specific behavioral signature: a single external source rapidly sweeping a high volume of distinct URIs, query parameters, or ports against internet-facing web/application assets within a short window. Rather than matching on scanner tool names or user-agent strings (which are trivially spoofed or stripped), this detection keys on rate and breadth — a burst of requests from one source IP hitting many unique paths/params/ports on a public-facing WAF, reverse proxy, or perimeter firewall in a tight time window is a strong behavioral indicator of automated vulnerability scanning regardless of tooling. Sandworm Team, APT41, and Magic Hound have all conducted large-scale internet-facing vulnerability scanning sweeps as a precursor to exploitation of public-facing applications (T1190), and this pattern is equally produced by commodity scanners, bug bounty researchers, and unauthorized red team activity. The detection is intentionally tool-agnostic and behavior-based — no CVE or vulnerability-specific payload matching is performed here since that is scan-target-dependent and better covered by WAF/IDS signature rules.
MITRE ATT&CK
- Tactic
- Reconnaissance
Sumo Detection Query
_sourceCategory=*waf* OR _sourceCategory=*firewall* OR _sourceCategory=*proxy*
| json field=_raw "src_ip", "url", "status", "dest_port" as src_ip, url, status, dest_port
| parse regex field=url "(?<uri_path>[^\?]+)"
| timeslice 10m
| stats count as request_count, count_distinct(uri_path) as unique_uris, count_distinct(dest_port) as unique_dest_ports by src_ip, _timeslice
| where unique_uris >= 40 or request_count >= 150
| sort - request_countSumo Logic search aggregating WAF/firewall/proxy log categories into 10-minute time slices per source IP, computing request count and unique URI/port cardinality to surface the same external burst/sweep signature as the KQL and SPL versions.
Data Sources
Required Tables
False Positives & Tuning
- Authorized vulnerability management scans from documented scanner IP ranges
- Search engine crawlers generating high URI uniqueness during a full site crawl
- Load testing and synthetic monitoring tools generating high request volume
Other platforms for THREAT-Recon-ExternalVulnScannerBurstDetection
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External Burst Scan Against a Web Endpoint with ffuf
Expected signal: WAF/reverse-proxy access log entries showing 60 requests from the local test source in a short window, each with a distinct URI path (/test-path-1 through /test-path-60) and query parameter. If a firewall/CEF-normalized log pipeline is present, this appears as CommonSecurityLog entries with a shared SourceIP and high UniqueUris count within the burst window.
- Test 2Simulate Multi-Port Sweep Against a Single External-Facing Host
Expected signal: Firewall/NetFlow connection logs showing a burst of connection attempts from the source IP to 12 distinct destination ports on the target host within seconds. Sysmon Event ID 3 (Network Connection) on the target if endpoint monitoring is present.
References (5)
- https://attack.mitre.org/techniques/T1595/002/
- https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-014_Vulnerability_Scanning
- https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
- https://github.com/ffuf/ffuf
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-ExternalVulnScannerBurstDetection — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.