Vulnerability Scanner Activity Detection

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects the execution of processes with command lines containing keywords associated with common vulnerability scanners such as 'scanner', 'nessus', or 'qualys'. It aggregates these events by computer and account over one-hour intervals to identify potential vulnerability scanning activity within the environment.