ATT&CK technique
View on MITRE ATT&CK →
T1595.002
Vulnerability Scanning
Reconnaissance
13 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| sigma | DNS Query to External Service Interaction Domains | test | 2026-10-13 |
| elastic | Web Server Potential SQL Injection Request | production | 2026-09-18 |
| elastic | Web Server Discovery or Fuzzing Activity | production | 2026-09-18 |
| elastic | Potential Spike in Web Server Error Logs | production | 2026-09-18 |
| elastic | Web Server Potential Spike in Error Response Codes | production | 2026-09-18 |
| elastic | Web Server Suspicious User Agent Requests | production | 2026-09-18 |
| elastic | Potential Linux Hack Tool Launched | production | 2026-09-18 |
| elastic | Web Server Potential Command Injection Request | production | 2026-09-18 |
| splunk | Cisco Secure Firewall - High Volume of Intrusion Events Per Host | production | 2026-05-13 |
| splunk | Cisco Secure Firewall - Repeated Blocked Connections | production | 2026-05-13 |
| splunk | Internal Vulnerability Scan | experimental | 2026-05-13 |
| splunk | Cisco Secure Firewall - Blocked Connection | production | 2026-05-13 |
| splunk | Windows Detect Network Scanner Behavior | production | 2026-05-13 |