Techniques › T1595 › T1595.002
T1595.002 Vulnerability Scanning
reconnaissance — PRE · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1595.002
0
KEV CVEs mapped here
<p>Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.</p><p>These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0867 Detection of Vulnerability Scanning v1.0
AN1999 PREMonitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1595.002
Author: Florian Roth (Nextron Systems), Matt Kelly (list of domains)
· 2022-06-07 (modified 2026-07-23) · logsource: category=dns · aff715fa-4dd5-497a-8db3-910bea555566
Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.
These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security
researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and
Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain.
A detection indicates that a host on your network resolved one of these domains, which may mean:
(1) an attacker is actively probing or exploiting a vulnerable service and using the callback to
confirm code execution or data exfiltration,
(2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets.
Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session),
and any concurrent outbound connections or process activity to determine intent.
Rules tagged at the parent level (attack.t1595) 3
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Joseph A. M.
· 2025-08-02 · logsource: category=proxy · 1712bafe-be05-4a0e-89d4-17a3ed151bf5
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2024-01-11 · logsource: product=windows category=process_creation · b1cb4ab6-ac31-43f4-adf1-d9d08957419c
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · b37998de-a70b-4f33-b219-ec36bf433dc0
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.