T1595 Active Scanning
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather.…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- DNS Query to External Service Interaction Domainshightest · dns
- PUA - PingCastle Execution From Potentially Suspicious Parenthightest · windows
- Grixba Malware Reconnaissance Activityhighexperimental · windows
- PUA - PingCastle Executionmediumtest · windows
- Potential Hello-World Scraper Botnet Activitymediumexperimental · proxy
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.