| ID | Name |
|---|---|
| T1595.001 | Scanning IP Blocks |
| T1595.002 | Vulnerability Scanning |
| T1595.003 | Wordlist Scanning |
Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.
These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.[1] Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application).
| ID | Name | Description |
|---|---|---|
| G0007 | APT28 |
APT28 has performed large-scale scans in an attempt to find vulnerable servers.[2] |
| G0016 | APT29 |
APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.[3] |
| G0096 | APT41 |
APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.[4] |
| G0143 | Aquatic Panda |
Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).[5] |
| C0029 | Cutting Edge |
During Cutting Edge, threat actors used the publicly available Interactsh tool to identify Ivanti Connect Secure VPNs vulnerable to CVE-2024-21893.[6] |
| G0035 | Dragonfly |
Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.[7] |
| G1006 | Earth Lusca |
Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.[8] |
| G1003 | Ember Bear |
Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.[9] |
| G0059 | Magic Hound |
Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.[10][11] |
| G0034 | Sandworm Team |
Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.[12] |
| G0139 | TeamTNT |
TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.[13] |
| G0123 | Volatile Cedar |
Volatile Cedar has performed vulnerability scans of the target server.[14][15] |
| G1035 | Winter Vivern |
Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.[16] |
| ID | Mitigation | Description |
|---|---|---|
| M1056 | Pre-compromise |
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0029 | Network Traffic | Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |
| Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. |