Vulnerability Scanning
Subtechnique · ATTACK:enterprise:T1595.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1595.002",
"title": "Vulnerability Scanning",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1595/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--5502c4e9-24ef-4d5f-8ee9-9e906c2f82c4",
"external_id": "T1595.002",
"domain": "enterprise",
"created": "2020-10-02T16:55:16.047Z",
"modified": "2026-05-12T15:12:00.633Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"reconnaissance"
],
"source_references": [
{
"source_name": "OWASP Vuln Scanning",
"url": "https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-014_Vulnerability_Scanning"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--105a37da-145b-4143-8641-566350cd143c
US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1509c545-be16-42be-8ec8-140b13f74555
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:G0123 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1637c874-852e-4ab9-b6e0-2c855da74ef0
CheckPoint Volatile Cedar March 2015 · ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17a16ae3-ee83-461b-aa3a-7904415f2e62
CISA Leviathan 2024ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35b0668b-312b-4cf4-baff-cda407575dc4
CISA GRU29155 2024ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52964a10-308f-4661-9081-77f1d3af1f3e
Rostovcev APT41 2021ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52c980ba-459b-4d3e-a0a8-f0ba3d2b6e3a
Trend Micro TeamTNTATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54b73912-002f-43ca-b8a2-7439aff45aab
TrendMicro Pawn Storm 2019ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a310c4b-4dab-45ad-80ef-351549c9cd65
Anthropic AI Orchestrated Campaign NOV 2025ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dca82b3-7a95-4fcd-862e-6337eea49306
Check Point APT35 CharmPower January 2022 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8aec2c68-c1c5-4b96-9511-a3018d89ce2f
DOJ FBI Handala Hack March 2026ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bc0b5e1-d9be-4303-b396-df990c664c4b
Cybersecurity Advisory SVR TTP May 2021ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae6add8b-17b3-4d50-be1a-8e4efec7fc01
ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b32c0514-83e8-4822-98fd-f675896324c1
SentinelOne WinterVivern 2023ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcd8dfe5-6f81-406c-a06a-7aa83db91a5e
CrowdStrike AQUATIC PANDA December 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5d4cfac-aa9a-4dfb-a991-e81f70a937e2
CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6ccc849-9c1a-4b5f-85af-eb141bc19a0a
AI-Mexico-Govt-Breach · AI-Mexico-Govt-CompromiseATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0e8cd30-04d6-457c-b4c1-34145f182dad
TrendMicro EarthLusca 2022ATTACK:enterprise:T1595.002 → subtechnique-of → ATTACK:enterprise:T1595
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3fe170d-55c7-4f98-9d39-6ee28403ce87
ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e86fefd2-7f69-4dfe-92e4-8c62421c8db6
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9304e7f-8ce3-488d-b5b7-32351024fe4a
SOCRadar_ShinyHunters_Mar2024