Recon Scanner UA/Path Fingerprinting Against Perimeter Hosts (T1592)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•2

This rule monitors web server logs (IIS, W3C, and Azure Application Gateway) for incoming traffic that matches known malicious or automated vulnerability scanners, as well as requests for common system fingerprinting paths (such as /server-status or /.git/config). The rule aggregates these hits by source IP address to identify potential active reconnaissance or vulnerability scanning attempts.