ATT&CK T1595.002 - Vulnerability Scanner Detected (Nmap/Masscan UA)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects network reconnaissance activity by identifying HTTP user-agent strings commonly associated with vulnerability scanners like Nmap or Masscan. It specifically looks for the string 'Nmap' within the HTTP user-agent header in traffic flowing from the internal network to a server.