Active Scanning T1595
Tactic: Reconnaissance
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.
Events covered
3 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Authoring guide
Patterns shared across the 65 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (106 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (693 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (25 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 5 rules
- DNS Query to External Service Interaction Domains
- Grixba Malware Reconnaissance Activity
- Potential Hello-World Scraper Botnet Activity
- PUA - PingCastle Execution
- PUA - PingCastle Execution From Potentially Suspicious Parent
Elastic 17 rules
- Inbound Connection to an Unsecure Elasticsearch Node
- Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected
- Potential Linux Hack Tool Launched
- Potential Network Scan Detected
- Potential Network Sweep Detected
- Potential Spike in Web Server Error Logs
- Potential SYN-Based Port Scan Detected
- Spike in Firewall Denies
- Spike in Network Traffic
- Spike in Network Traffic To a Country
- Suspicious Network Tool Launch Detected via Defend for Containers
- Suspicious Network Tool Launched Inside A Container
- Web Server Discovery or Fuzzing Activity
- Web Server Potential Command Injection Request
- Web Server Potential Spike in Error Response Codes
- Web Server Potential SQL Injection Request
- Web Server Suspicious User Agent Requests
Splunk 11 rules
- Attacker Tools On Endpoint
- Cisco SA - Automated Web Reconnaissance via HTTP Access Errors
- Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity
- Cisco Secure Firewall - Blocked Connection
- Cisco Secure Firewall - High Volume of Intrusion Events Per Host
- Cisco Secure Firewall - Repeated Blocked Connections
- HTTP Rapid POST with Mixed Status Codes
- Internal Vulnerability Scan
- Ollama Possible API Endpoint Scan Reconnaissance
- Windows Detect Network Scanner Behavior
- Windows Netspy Network Scanner Execution
Kusto 25 rules
- API - Kiterunner detection
- App Gateway WAF - Scanner Detection
- AWSCloudTrail - Suspicious AWS CLI Command Execution
- BitSight - diligence risk category detected
- BTP - Failed access attempts across multiple BAS subaccounts
- Claroty - Threat detected
- Dataverse - Suspicious use of Web API
- Disks Alerts From Prancer
- Flow Logs Alerts for Prancer
- NetworkSecurityGroups Alert From Prancer
- OCI - Multiple rejects on rare ports
- OCI - SSH scanner
- PAC high severity
- Palo Alto - possible nmap scan on with top 100 option
- PaloAlto - Possible port scan
- Port Scan
- Port Sweep
- Registries Alerts for Prancer
- Sites Alerts for Prancer
- Storage Accounts Alerts From Prancer
- Subnets Alerts for Prancer
- Vaults Alerts for Prancer
- Virtual Machines Alerts for Prancer
- VirtualNetworkPeerings Alerts From Prancer
- XbowNewAssetDiscovered