ATT&CK technique
View on MITRE ATT&CK →
T1595.001
Scanning IP Blocks
Reconnaissance
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential SYN-Based Port Scan Detected | production | 2026-09-18 |
| elastic | Potential Network Sweep Detected | production | 2026-09-18 |
| elastic | Potential Network Scan Detected | production | 2026-09-18 |
| elastic | Web Server Suspicious User Agent Requests | production | 2026-09-18 |
| elastic | Spike in Network Traffic To a Country | production | 2026-09-18 |
| elastic | ICMP Timestamp or Information Request from the Internet | production | 2026-09-18 |
| splunk | Windows Detect Network Scanner Behavior | production | 2026-05-13 |
| sigma | Grixba Malware Reconnaissance Activity | experimental | 2025-11-26 |