Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Linux Network Service Scanning Tools Execution

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

ATT&CK coverage

Outside the enterprise matrix

T1046

Detection requirements

Log source product: linux
Log source category: process_creation

What the source says

What fires this without an attack behind it

Legitimate administration activities

References

https://github.com/Tib3rius/AutoRecon
https://github.com/projectdiscovery/naabu
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md

Tagged by the source as

attack.discovery

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.