T1595.002 Vulnerability Scanning

Technique

T1595.002

Tactics

Reconnaissance

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

1

Elastic, Splunk

11

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1595/002

MITRE description

Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-09-25 Google Threat Intelligence: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

Detection coverage

SigmaHQ community rules

• DNS Query to External Service Interaction Domains (core)

Elastic and Splunk rules

• Web Server Potential Command Injection Request (elastic)
• Web Server Potential SQL Injection Request (elastic)
• Web Server Discovery or Fuzzing Activity (elastic)
• Potential Spike in Web Server Error Logs (elastic)
• Web Server Potential Spike in Error Response Codes (elastic)
• Web Server Suspicious User Agent Requests (elastic)
• Potential Linux Hack Tool Launched (elastic)
• Windows Detect Network Scanner Behavior (splunk)
• Cisco Secure Firewall - Blocked Connection (splunk)
• Cisco Secure Firewall - High Volume of Intrusion Events Per Host (splunk)
• Cisco Secure Firewall - Repeated Blocked Connections (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.