Techniques › T1595
T1595 Active Scanning
reconnaissance — PRE · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
3
Sigma rules tagged attack.t1595
1
KEV CVEs mapped here
<p>Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.</p><p>Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | exploitation technique | Mapped | 2025-01-08 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0830 Detection of Active Scanning v1.0
AN1962 PREMonitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1595
Author: Joseph A. M.
· 2025-08-02 · logsource: category=proxy · 1712bafe-be05-4a0e-89d4-17a3ed151bf5
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2024-01-11 · logsource: product=windows category=process_creation · b1cb4ab6-ac31-43f4-adf1-d9d08957419c
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · b37998de-a70b-4f33-b219-ec36bf433dc0
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.