# T1595 - Active Scanning

## SOC Recommendation
Investigate Active Scanning activity in the context of Reconnaissance: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block persistent, high-volume scanning IPs at WAF | Medium | No | Yes |
| If targeted CVE scanning: escalate patching of that vulnerab | Low | No | Yes |
| Enable WAF in Prevention mode if in Detection mode | Low | No | Yes |
| Add scanning IP to Sentinel TI watchlist for correlation | Low | No | Yes |

## KQL
```kql
let WafScans = (
    AzureDiagnostics
    | where TimeGenerated >= ago(1h)
    | where Category in ("ApplicationGatewayFirewallLog", "ApplicationGatewayAccessLog", "FrontdoorWebApplicationFirewallLog")
    | where action_s in ("Blocked", "Detected")
    | where details_message_s has_any (
        "nmap", "masscan", "shodan", "nuclei", "nikto", "sqlmap", "dirb", "gobuster",
        "zgrab", "zmap", "metasploit", "hydra", "burp suite", "nessus", "openvas",
        "scanner", "vulnerability scanner", "wpscan"
    )
        or ruleSetType_s has_any ("Microsoft_BotManagerRuleSet", "Microsoft_DefaultRuleSet")
    | summarize ScanCount = count(), TargetPaths = make_set(requestUri_s, 10)
        by SourceIP = clientIp_s, Hostname = hostname_s
    | where ScanCount > 20
    | extend DetectionType = "WAF_Scanner_Fingerprint"
);
let FirewallScans = (
    CommonSecurityLog
    | where TimeGenerated >= ago(1h)
    | where Activity has_any ("portscan", "port scan", "Port Scan", "TCP SYN", "SYN Flood", "Nmap", "Scanner")
        or DeviceEventClassID has_any ("portscan", "probe")
    | summarize ScanCount = count(), UniqueDestPorts = dcount(DestinationPort)
        by SourceIP, Hostname = DestinationIP
    | where ScanCount > 50 or UniqueDestPorts > 20
    | extend DetectionType = "Firewall_Port_Scan"
);
WafScans
| union FirewallScans
| extend timestamp = now(), IPCustomEntity = SourceIP
| order by ScanCount desc
```
```kql
let Threshold = 3;
AGWFirewallLogs
| where Action == "Matched"
| where Message contains "Found User-Agent associated with security scanner"
| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message, DetailedMessage, DetailedData
| join kind = inner(
AGWFirewallLogs
| where Action == "Blocked"
) on TransactionId
| extend Uri = strcat(Hostname,RequestUri)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(TransactionId), Message = make_set(Message), Detail_Message = make_set(DetailedMessage), Detail_Data = make_set(DetailedData), Total_TransactionId = dcount(TransactionId) by ClientIp, Uri, Action
| where Total_TransactionId >= Threshold
```
```kql
blacklens_CL
| summarize arg_max(TimeGenerated, *) by id
| extend AlertSeverity = case(
    tolower(severity) == "critical", "High",
    tolower(severity) == "high", "High",
    tolower(severity) == "medium", "Medium",
    tolower(severity) == "low", "Low",
    "Informational"
)
```

## Escalation Criteria
- Active Scanning activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.