Threat Hunting With Python Part 2: Detecting Nmap Behavior with Bro HTTP Logs
Summary: The second post in a Dragos threat-hunting series moves from hardcoded Nmap URI indicators to behavioral detection in Bro IDS HTTP logs, using a 2015 4SICS conference geek lounge packet capture covering five hours. The author shows that removing the dominant 200 status code reveals a spike across at least five HTTP status code types, and that the Nmap Scripting Engine user agent and a "-" (no user agent) value appear during the scan window from 0500-0700 on 2015-10-21.
Bottom line: The author notes you won't detect an attacker who skips Nmap's '-A' option or scripts that generate HTTP traffic, since their behavior never appears in HTTP logs - so a hunt built only on this data has a known blind spot.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026