• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Webworm Executes Nuclei and dirsearch

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Daniel Jeremiah@daniyyell
    •updated Jun 20, 2026•0•0•10

    Detects vulnerability and directory scanners (Nuclei, dirsearch, or Python scripts) launched with output files or target lists covering numerous web servers. This activity is associated with the Webworm threat group.

    Cortex XDR

    Tags

    T1595.002 - Vulnerability ScanningT1595.001 - Scanning IP BlocksTA0043 - ReconnaissanceCommand ExecutionVulnerability Scan DetectedWindows

    Found in

    • Webworm APT 2025 European Campaign and Custom ToolsetLast updated May 21, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?