Network traffic matching known vulnerability scanner/pentest tool signatures
Detects network traffic on Microsoft Defender for Endpoint-monitored devices that matches signatures or packet content associated with known vulnerability scanning and penetration-testing tools (e.g. Nmap, Burp Suite, Nessus, Qualys, Metasploit, Nuclei, Shodan). Parses AdditionalFields JSON from DeviceNetworkEvents to inspect SamplePacketContent, SignatureName, and SignatureMatchedContent. Ambiguous common-word tool names (zap, vega, hydra, medusa, retina, intruder) are matched only against the curated SignatureName/SignatureMatchedContent fields to avoid false positives from raw packet content. Excludes traffic from known, sanctioned vulnerability-management scanner IPs to reduce noise from authorized scans.
Microsoft Sentinel (KQL)
