Home/ MITRE Matrix/ Reconnaissance/ T1595.002

T1595.002Vulnerability Scanning

T1595.002 — Vulnerability Scanning is a MITRE ATT&CK technique in the Reconnaissance tactic. Clankerusecase tracks 9 detection use cases covering it and 5 threat-intel articles citing it.

Reconnaissance

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

5Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1595 · Active Scanning

Use cases covering this technique (9)

Windows Detect Network Scanner Behavior ESCU actions · hunting P Cisco Secure Firewall - Blocked Connection ESCU actions · hunting P Cisco Secure Firewall - High Volume of Intrusion Events Per Host ESCU actions · hunting P Cisco Secure Firewall - Repeated Blocked Connections ESCU actions · hunting P Internal Vulnerability Scan ESCU actions · alerting P [LLM] External / non-internal HTTP access to Ivanti Sentry /mics admin portal Bespoke delivery · hunting DSΣPDD [LLM] JDY-style outbound recon scanning originating from internal IoT / network appliances Bespoke recon · hunting DSPDDCS [LLM] Volumetric PATCH probing against FileBrowser Quantum public share endpoint Bespoke recon · alerting SPDD [LLM] Non-browser User-Agent against YesWiki Bazar form-import endpoint — CVE-2026-46670 exploit tooling Bespoke exploit · alerting SΣP

Articles citing this technique (5)

high CISA orders feds to patch actively exploited Ivanti flaw by Sunday art-34

crit China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance art-59

crit [GHSA / CRITICAL] CVE-2026-48777: FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory art-214

crit [GHSA / CRITICAL] CVE-2026-46670: YesWiki: Unauthenticated SQL Injection art-216

crit Webworm: New burrowing techniques art-240