---
{
  "title": "Active Scanning",
  "summary": "Active scanning probes target infrastructure to learn reachable services or weaknesses.",
  "topic": "offensive",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    5
  ],
  "aliases": [
    "T1595"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1595: Active Scanning",
      "url": "https://attack.mitre.org/techniques/T1595"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Active scanning probes target infrastructure to learn reachable services or weaknesses. It creates observable interactions, unlike passive research of existing public data.

MITRE ATT&CK catalogs this behavior as **T1595**, within reconnaissance. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.

## An investigation example

An internet-facing service receives coordinated requests for many paths or ports before a more specific attempt.

## Evidence to examine

Review source patterns, request details, timing, exposed services, and any later target-side execution.

## A common analytical pitfall

Scanning is not successful exploitation, and legitimate assessment requires an approved scope.

## Response considerations

Preserve probe evidence, distinguish background scanning from confirmed impact, and address relevant external exposure and vulnerabilities.

## Separate probing from the later outcome

A fictional retailer observes requests to many unused paths on its public website. The pattern may indicate discovery activity, but it does not establish that the requester found a weakness or accessed customer records. Build a timeline that distinguishes the probes, any subsequent targeted request, and evidence of server-side effects.

Source patterns need context. A shared address may belong to a scanner service, proxy, or multiple users. Request timing and content can support a behavioral assessment without proving a particular human operator. Compare the observation with approved assessments and expected monitoring before assigning malicious intent.

The target's exposure still matters even when attribution is uncertain. Review whether unnecessary services or outdated endpoints are reachable and who owns them. Reducing unsupported exposure can be useful regardless of which scanner generated the original event. Avoid making an incident claim solely because background internet scanning occurred.

## Write an evidence-based observation

For a classroom exercise, use a synthetic access log containing ordinary browsing and a short sequence of systematic path requests. Mark the fields that support a scanning hypothesis and those that remain unknown. Add a later successful login as a separate event and explain why temporal proximity alone does not prove a connection.

A defensive report should state what was seen, the affected interface, relevant timing, and whether any impact was confirmed. Authorized testing requires a written scope and agreed operational limits; a public address is not permission to probe it. This distinction helps learners study scanning behavior responsibly while developing the analytical habit of separating attempted discovery from successful compromise and attribution.

## Related concepts

- [[osint]]
- [[rules-of-engagement]]
- [[threat-intelligence]]
- [[search-open-websites-domains]]
- [[search-open-technical-databases]]
- [[develop-capabilities]]
- [[obtain-capabilities]]