Applied Cybernetics Group
T1595 Active Scanning
- Technique
T1595- Tactics
- Reconnaissance
- Research, 90 days
- 1
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 3
- Elastic, Splunk
- 29
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1595
MITRE description
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-21Microsoft Threat Intelligence: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Detection coverage
SigmaHQ community rules
- Potential Hello-World Scraper Botnet Activity (core)
- PUA - PingCastle Execution From Potentially Suspicious Parent (core)
- PUA - PingCastle Execution (core)
Elastic and Splunk rules
- Web Server Potential Command Injection Request (elastic)
- Web Server Potential SQL Injection Request (elastic)
- Web Server Discovery or Fuzzing Activity (elastic)
- Potential Spike in Web Server Error Logs (elastic)
- Web Server Potential Spike in Error Response Codes (elastic)
- Web Server Suspicious User Agent Requests (elastic)
- AWS EKS Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected (elastic)
- Suspicious Network Tool Launch Detected via Defend for Containers (elastic)
- GKE Anonymous Endpoint Permission Enumeration (elastic)
- Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected (elastic)
- Suspicious Network Tool Launched Inside A Container (elastic)
- Potential Linux Hack Tool Launched (elastic)
- Spike in Firewall Denies (elastic)
- Spike in Network Traffic (elastic)
- Spike in Network Traffic To a Country (elastic)
- ICMP Timestamp or Information Request from the Internet (elastic)
- Potential Network Sweep Detected (elastic)
- Potential Network Scan Detected (elastic)
- Potential SIP Extension Enumeration (elastic)
- Potential Low-Packet Port Scan Detected (elastic)
- Inbound Connection to an Unsecure Elasticsearch Node (elastic)
- Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication (splunk)
- Cisco SD-WAN Multiple SSH key Authentication from Same Source (splunk)
- Ollama Possible API Endpoint Scan Reconnaissance (splunk)
- Attacker Tools On Endpoint (splunk)
Showing 25 of 29.