{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1595","id":"T1595","name":"Active Scanning","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1595","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"59c7be5cb12646d0954852a9bbdbde7157b3a92564fe55729b0f50fbd3b41a2b","description":"Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.\n\nAdversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1595","external_id":"T1595"},{"source_name":"Botnet Scan","description":"Dainotti, A. et al. (2012). Analysis of a “/0” Stealth Scan from a Botnet. Retrieved October 20, 2020.","url":"https://www.caida.org/publications/papers/2012/analysis_slash_zero/analysis_slash_zero.pdf"},{"source_name":"OWASP Fingerprinting","description":"OWASP Wiki. (2018, February 16). OAT-004 Fingerprinting. Retrieved October 20, 2020.","url":"https://wiki.owasp.org/index.php/OAT-004_Fingerprinting"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1595.001","id":"T1595.001","name":"Scanning IP Blocks","page":"techniques/enterprise/T1595.001/"},{"key":"enterprise/T1595.002","id":"T1595.002","name":"Vulnerability Scanning","page":"techniques/enterprise/T1595.002/"},{"key":"enterprise/T1595.003","id":"T1595.003","name":"Wordlist Scanning","page":"techniques/enterprise/T1595.003/"}],"telemetry":[{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1595","id":"T1595","name":"Active Scanning","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1595","technique_page":"techniques/enterprise/T1595/","page":"detections/enterprise/T1595/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"1712bafe-be05-4a0e-89d4-17a3ed151bf5","title":"Potential Hello-World Scraper Botnet Activity","status":"experimental","level":"medium","logsource":{"category":"proxy"},"data_path":"data/detection-rules/1712bafe-be05-4a0e-89d4-17a3ed151bf5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_hello_world_user_agent.yml","author":"Joseph A. M.","kind":"sigma"},{"id":"b1cb4ab6-ac31-43f4-adf1-d9d08957419c","title":"PUA - PingCastle Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b1cb4ab6-ac31-43f4-adf1-d9d08957419c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_pingcastle.yml","author":"Nasreddine Bencherchali (Nextron Systems), frack113","kind":"sigma"},{"id":"b37998de-a70b-4f33-b219-ec36bf433dc0","title":"PUA - PingCastle Execution From Potentially Suspicious Parent","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b37998de-a70b-4f33-b219-ec36bf433dc0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1595-1","technique_id":"T1595","title":"T1595 Active Scanning","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#reconnaissance","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":24,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L24","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"5e6bb0492e2e7eeee35df142a9bdf8270814b4e713330a45697b34f49049fa50","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(denied_or_failed_connections BY source_ip, 5m) >= threshold AND DISTINCT_COUNT(destination_port OR destination_host) >= threshold -> ALERT","log_sources":[{"title":"Network Firewall Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#52-network-firewall-logs"},{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"Network Intrusion Detection Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#61-network-intrusion-detection-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1595-1","technique_id":"T1595","title":"Repeated probing of public services — T1595 Active Scanning","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#external-service-scanning","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":24,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L24","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"37dc27c4def058932bc74f2aa18fc15e492ea3b67d80fb278719ff10d3124035","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"source address or source network.","expected_behavior":"ordinary clients contact a small set of exposed services.","deviation":"unusually high destination-port or destination-host fan-out within a short interval.","anomaly_types":[{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"}],"log_sources":[{"title":"Network Firewall Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#52-network-firewall-logs"},{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"}],"context_references":[{"title":"FortiGuard Incident Response Report H1 2023 — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fortiguard-ir-h1-2023.pdf"},{"title":"original source","url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/report-fortiguard-incident-response-1h-2023.pdf"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"}],"strategies":[{"id":"DET0830","name":"Detection of Active Scanning","url":"https://attack.mitre.org/detectionstrategies/DET0830","stix_id":"x-mitre-detection-strategy--7bbdcd3b-241e-4ec8-ab43-6bd2c34ae77d","relationship_id":"relationship--0331868e-bb86-4153-b91e-df857c51bb7e","description":"","analytics":[{"id":"AN1962","name":"Analytic 1962","guidance":"Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.\nMonitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).","url":"https://attack.mitre.org/detectionstrategies/DET0830#AN1962","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"Network Traffic","channel":"None","platforms":["PRE"],"analytic_id":"AN1962","source_url":"https://attack.mitre.org/detectionstrategies/DET0830#AN1962","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"Network Traffic","channel":"None","platforms":["PRE"],"analytic_id":"AN1962","source_url":"https://attack.mitre.org/detectionstrategies/DET0830#AN1962","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"nmap","name":"Nmap","page":"tools/nmap/","kind":"curated_tool","bases":["editorial_capability"],"evidence":[{"basis":"editorial_capability","description":"Nmap TCP connect scanning implements active probing in a pre-compromise reconnaissance scenario. Internal post-compromise service discovery remains T1046.","source_url":"https://nmap.org/book/man-port-scanning-techniques.html","guide_id":"f36d74d1b2c0","guide_url":"https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/","technique_url":"https://attack.mitre.org/techniques/T1595","reviewed_on":"2026-09-28"}],"guides":[{"id":"f36d74d1b2c0","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1","published_at":"2024-10-26","url":"https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0","archive_path":"docs/articles/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0.md","source_sha256":"976cadf83624ba0c723c03475eb784b4d8f24883134fbfeb8bc0fe070ab81965","tool_ids":["nmap"]},{"id":"d5a95569031c","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2","published_at":"2024-10-27","url":"https://1200km.com/articles/read/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c","archive_path":"docs/articles/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c.md","source_sha256":"51513cc49e2f90d50b0a3632c9f7aac3e2696ef7c885150873bd6fe195a1294d","tool_ids":["nmap"]},{"id":"450eec6e9db2","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 3","published_at":"2024-10-28","url":"https://1200km.com/articles/read/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2","archive_path":"docs/articles/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2.md","source_sha256":"2de93ed9c81f802a9121a97bcf8d3c022ea4481c04ef25d56a6a0ed5046edc1b","tool_ids":["nmap"]},{"id":"5ec77704057f","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts","published_at":"2024-10-30","url":"https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f","archive_path":"docs/articles/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f.md","source_sha256":"cec1a9e442358109fb5f3c66bfbe2c20096774176e7478a354e998e13df98756","tool_ids":["nmap"]},{"id":"e2acb6130be5","title":"Reinventing Recon: Nmap Meets ChatGPT","published_at":"2025-11-24","url":"https://1200km.com/articles/read/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5/","original_url":"https://medium.com/@1200km/reinventing-recon-nmap-meets-chatgpt-e2acb6130be5","archive_path":"docs/articles/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5.md","source_sha256":"6580ded0945cbd8a282299cf445cbaa6f8d43a2a81a4b57bf6c26fdd4cf088a7","tool_ids":["nmap"]}]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"nmap","name":"Nmap","page":"tools/nmap/","kind":"curated_tool","bases":["editorial_capability"],"evidence":[{"basis":"editorial_capability","description":"Nmap TCP connect scanning implements active probing in a pre-compromise reconnaissance scenario. Internal post-compromise service discovery remains T1046.","source_url":"https://nmap.org/book/man-port-scanning-techniques.html","guide_id":"f36d74d1b2c0","guide_url":"https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/","technique_url":"https://attack.mitre.org/techniques/T1595","reviewed_on":"2026-09-28"}],"guides":[{"id":"f36d74d1b2c0","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1","published_at":"2024-10-26","url":"https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0","archive_path":"docs/articles/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0.md","source_sha256":"976cadf83624ba0c723c03475eb784b4d8f24883134fbfeb8bc0fe070ab81965","tool_ids":["nmap"]},{"id":"d5a95569031c","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2","published_at":"2024-10-27","url":"https://1200km.com/articles/read/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c","archive_path":"docs/articles/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c.md","source_sha256":"51513cc49e2f90d50b0a3632c9f7aac3e2696ef7c885150873bd6fe195a1294d","tool_ids":["nmap"]},{"id":"450eec6e9db2","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 3","published_at":"2024-10-28","url":"https://1200km.com/articles/read/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2","archive_path":"docs/articles/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2.md","source_sha256":"2de93ed9c81f802a9121a97bcf8d3c022ea4481c04ef25d56a6a0ed5046edc1b","tool_ids":["nmap"]},{"id":"5ec77704057f","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts","published_at":"2024-10-30","url":"https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f","archive_path":"docs/articles/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f.md","source_sha256":"cec1a9e442358109fb5f3c66bfbe2c20096774176e7478a354e998e13df98756","tool_ids":["nmap"]},{"id":"e2acb6130be5","title":"Reinventing Recon: Nmap Meets ChatGPT","published_at":"2025-11-24","url":"https://1200km.com/articles/read/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5/","original_url":"https://medium.com/@1200km/reinventing-recon-nmap-meets-chatgpt-e2acb6130be5","archive_path":"docs/articles/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5.md","source_sha256":"6580ded0945cbd8a282299cf445cbaa6f8d43a2a81a4b57bf6c26fdd4cf088a7","tool_ids":["nmap"]}]}],"software":[],"actors":[{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has scanned victim environments for open ports and services.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025) ","relationship_id":"relationship--5a00d8fb-6d31-4d59-847b-7bf815af171c","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.","relationship_id":"relationship--004fbe29-2537-418e-9951-a2750a5fa901","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":"bounded_nmap_connect_scan"},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1593":"/ttp-simulation/techniques/enterprise/T1593/","T1596":"/ttp-simulation/techniques/enterprise/T1596/","T1587":"/ttp-simulation/techniques/enterprise/T1587/","T1588":"/ttp-simulation/techniques/enterprise/T1588/","T1133":"/ttp-simulation/techniques/enterprise/T1133/","T1190":"/ttp-simulation/techniques/enterprise/T1190/","T1595":"/ttp-simulation/techniques/enterprise/T1595/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1595","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}