PENTEST LAB Multi-Agent Scanning: Nuclei/ffuf/sqlmap Tool Signatures

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

Detects network traffic consistent with automated penetration testing frameworks such as Nuclei, ffuf, or sqlmap. This rule monitors HTTP user-agent strings and triggers an alert if high-frequency scanning activity from a single source is observed within a 60-second window, which is indicative of automated reconnaissance or vulnerability scanning.