Kimera Recon Engine: subfinder/assetfinder/gobuster/dnsx/naabu Concurrent Execution

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects execution of known reconnaissance tools and scripts associated with the Kimera framework, including subdomain and asset enumeration utilities (e.g., subfinder, nuclei, httpx) or custom Python scripts. The rule also monitors for reconnaissance-related ulimit adjustments and concurrent bursts of multiple enumeration tools, which are indicative of automated scanning activity.