T1595 Active Scanning — Detection Rules

Source-backed rule directory

• Potential Hello-World Scraper Botnet Activity · experimental · medium · {"category":"proxy"}
• PUA - PingCastle Execution · test · medium · {"category":"process_creation","product":"windows"}
• PUA - PingCastle Execution From Potentially Suspicious Parent · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1595 Active Scanning

COUNT(denied_or_failed_connections BY source_ip, 5m) >= threshold AND DISTINCT_COUNT(destination_port OR destination_host) >= threshold -> ALERT

• Network Firewall Logs
• Network Flow Logs
• Network Intrusion Detection Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0830 Detection of Active Scanning

AN1962 Analytic 1962

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).