T1595Reconnaissance
Active Scanning
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather.…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
3 Sigma rules tagged T1595Active ScanningT15953 general rules
- PUA - PingCastle Execution From Potentially Suspicious Parenthightest
- PUA - PingCastle Executionmediumtest
- Potential Hello-World Scraper Botnet Activitymediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Active Scanning
1 CVE, by priority. Each link shows its badge.- CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.0T1595Active ScanningT1190Exploit Public-Facing Application+4 more · 2 reportsMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.02%85.4priority