Nessus Vulnerability Scanner HTTP Request

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•7

This rule detects HTTP requests originating from the Nessus vulnerability scanner. It specifically looks for the string "Nessus" (case-insensitive) within the HTTP User-Agent header of outgoing HTTP traffic from the protected network.