Home/ MITRE Matrix/ Reconnaissance/ T1595.002

T1595.002Vulnerability Scanning

T1595.002 — Vulnerability Scanning is a MITRE ATT&CK technique in the Reconnaissance tactic. Clankerusecase tracks 9 detection use cases covering it and 5 threat-intel articles citing it.

Reconnaissance

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

5Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1595 · Active Scanning

Use cases covering this technique (9)

Windows Detect Network Scanner Behavior ESCU actions · hunting P Cisco Secure Firewall - Blocked Connection ESCU actions · hunting P Cisco Secure Firewall - High Volume of Intrusion Events Per Host ESCU actions · hunting P Cisco Secure Firewall - Repeated Blocked Connections ESCU actions · hunting P Internal Vulnerability Scan ESCU actions · alerting P [LLM] IPMI/BMC service discovery scan across many hosts (UDP/623) Bespoke recon · alerting DSPDDCSCW [LLM] Unauthenticated access to MantisBT admin/install.php on a production host (CVE-2026-52847) Bespoke recon · hunting SΣP [LLM] Better Auth OIDC discovery probe followed by token/registration endpoint access (CVE-2026-53512/53513 recon) Bespoke recon · hunting SP [LLM] Recon scanning of 9router unauthenticated /api/* endpoints from single source Bespoke recon · hunting SP

Articles citing this technique (5)

crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login art-52

crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-169

crit [GHSA / CRITICAL] CVE-2026-53513: @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints art-228

crit [GHSA / CRITICAL] GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats art-241

crit Webworm: New burrowing techniques art-413