CyberStack

MITRE ATT&CK / Techniques / T1595.002

Active Scanning: Vulnerability Scanning

ID
T1595.002
Tactics
TA0043 Reconnaissance
Sub-technique of
T1595 Active Scanning
Platforms
PRE
Data sources
Network Traffic Content, Network Traffic Flow
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.[1] Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application).

Detection

Mitigations (1)

M1056 Pre-compromise

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

Groups (15)

References

  1. OWASP Vuln Scanning