Security Scanner Detection

Alert ID: scanner_detection MITRE ATT&CK: T1595 – Active Scanning · T1046 – Network Service Scanning

---

Severity / Criticality

Level	Condition
Low	Information tools such as WhatWeb, curl, wget
Medium	Directory bruteforcers such as Gobuster/DirBuster, WAF detectors
High	Vulnerability scanners such as Nikto, WPScan, Nessus, Acunetix
Critical	Automated injection/exploitation tools such as SQLMap or Metasploit

---

Why is it considered malicious?

• Automated reconnaissance: often the first phase of a targeted attack.
• Vulnerability discovery: broad mapping of exploitable vectors.
• Attack preparation: inventory and prioritization of targets.
• Possible automatic exploitation: scanner plus vulnerability can lead to imminent compromise.

---

When does the alert trigger?

• User-Agent detection against more than 50 known patterns.
• Behavioral analysis: bursts of 404s and sequential requests to common paths.
• Severity increases if login attempts, malicious requests, or payloads are observed.
• Cooldown: 5 minutes per IP/tool.
• Automatic critical response for tools categorized as exploitation tools, such as SQLMap or Metasploit.

---

Technical Indicators (IOCs)

Type	Example
user_agent	sqlmap/1.5.2#stable
user_agent	Mozilla/5.0 (compatible; Nmap Scripting Engine)
user_agent	WPScan vX.Y.Z
user_agent	Nikto/X.Y.Z
behavior	Multiple 404s in <1 second against common paths
behavior	Enumeration patterns: /wp-admin/, /wp-login.php, .env, /backup/, wp-content/plugins/

---

Common false positives

• Legitimate SEO crawlers and search engines.
• Monitoring or uptime tools.
• Contracted security services or authorized penetration tests.
• Developers using curl, wget, or diagnostic tools.

Tip

Always verify source IP, context such as time and ASN, and authorization before blocking.

---

Investigation steps

1. Analyze User-Agent and frequency:

   grep -iE "nikto|sqlmap|wpscan|nmap" access.log

2. List tested paths and count 404s:

   awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -nr

3. Measure scope: scan duration, total requests, sizes, and patterns.

4. Correlate with WAF/IDS data: triggered rules and previous blocks.

5. For critical tools, assume active exploitation intent and escalate to urgent response.

---

Recommended mitigations

Immediate

Danger

• Block IPs that combine suspicious User-Agents with scanning behavior.
• Apply aggressive rate limiting and tarpitting for persistent sources.
• Investigate urgently if the tool is SQLMap or Metasploit.
• Deploy honeypots or fake endpoints to collect attacker TTPs.

Preventive

Tip

Filter known User-Agents at the web-server level (Nginx):

if ($http_user_agent ~* (nikto|sqlmap|wpscan|nmap|acunetix)) {
    return 403;
}

• Implement tarpit/slowdown behavior for persistent scanners.
• Return fake responses for administrative paths in unauthorized layers.
• Use WAF/CloudFlare anti-scanner rules and global rate limiting.
• Configure Fail2ban jails based on scanning patterns and 404 floods.

---

References

• MITRE ATT&CK T1595 / T1046
• SANS — Detecting Scanners and Reconnaissance
• SecLists — common User-Agents and scan signatures