Active Scanning

T1595

Technique with 3 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).

Detection rules17

Rules on DetectionCode tagged with T1595 or one of its sub-techniques.

Sigma4

Rule	Level	Log source	Technique
DNS Query to External Service Interaction Domains	high	NULL / dns	T1595.002
PUA - PingCastle Execution From Potentially Suspicious Parent	high	windows / process_creation	T1595
Potential Hello-World Scraper Botnet Activity	medium	NULL / proxy	T1595
PUA - PingCastle Execution	medium	windows / process_creation	T1595

Splunk13

Rule	Type	Risk	Data source	Technique
Attacker Tools On Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1595
Cisco SA - Automated Web Reconnaissance via HTTP Access Errors	Anomaly	NULL	Cisco Secure Access Proxy	T1595
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity	Hunting	NULL	Cisco SD-WAN Service Proxy Access Logs	T1595
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication	Hunting	NULL	Cisco SD-WAN Auth Log	T1595
Cisco SD-WAN Multiple SSH key Authentication from Same Source	Hunting	NULL	Cisco SD-WAN Auth Log	T1595
Cisco Secure Firewall - Blocked Connection	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1595.002
Cisco Secure Firewall - High Volume of Intrusion Events Per Host	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1595.002
Cisco Secure Firewall - Repeated Blocked Connections	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1595.002
HTTP Rapid POST with Mixed Status Codes	Anomaly	NULL	Nginx Access	T1595
Internal Vulnerability Scan	TTP	NULL		T1595.002
Ollama Possible API Endpoint Scan Reconnaissance	Anomaly	NULL	Ollama Server	T1595
Windows Detect Network Scanner Behavior	Anomaly	NULL	Sysmon EventID 3	T1595.001 T1595.002
Windows Netspy Network Scanner Execution	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1595

Sub-techniques3

ID	Name	Examples
T1595.001	Scanning IP Blocks	3
T1595.002	Vulnerability Scanning	18
T1595.003	Wordlist Scanning	2

Groups0

None recorded.

Software0

None recorded.

Campaigns1

Triton Safety Instrumented System Attack

Procedure examples1

Campaigns1

Used by	Procedure example
CampaignTriton Safety Instrumented System Attack	In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest. FireEye TEMP.Veles 2018

References2

Botnet Scan Open source
Dainotti, A. et al. (2012). Analysis of a “/0” Stealth Scan from a Botnet. Retrieved October 20, 2020.
OWASP Fingerprinting Open source
OWASP Wiki. (2018, February 16). OAT-004 Fingerprinting. Retrieved October 20, 2020.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.