Kimera Distributed Recon Framework - subfinder/gobuster/dnsx/naabu/httpx Execution

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

This rule detects the execution of common security reconnaissance and enumeration tools (e.g., subfinder, nuclei, gobuster, httpx) or suspicious Python scripts typically associated with scanning and discovery activities. It uses Sysmon Process Creation events and flags instances where high-volume scanning parameters are used or where multiple distinct tools or executions are observed on a single host.