ATT&CK T1595.002 - Masscan User-Agent Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects network reconnaissance activity by identifying HTTP requests where the User-Agent header contains the string "masscan". Masscan is a fast internet port scanner, and its User-Agent string often indicates scanning activity, which aligns with the MITRE ATT&CK technique T1595.002 for active scanning during reconnaissance.