Automated Recon Swarm Probing Subdomains, Auth Flows, and Injection Payloads
Detects high-velocity, automated web activity originating from a single source IP that simultaneously performs widespread endpoint enumeration, tests sensitive authentication flows, and attempts common injection attack payloads. This behavior is indicative of an automated scanner, crawler, or malicious botnet agent performing rapid discovery and exploitation attempts.
Microsoft Sentinel (KQL)
