{"id":"T1595.003","name":"Wordlist Scanning","url":"https://attack.mitre.org/techniques/T1595/003","tactics":["reconnaissance"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0868","stix_id":"x-mitre-detection-strategy--95d3b171-2fc3-4e58-a5c9-4d98c3691c88","name":"Detection of Wordlist Scanning","url":"https://attack.mitre.org/detectionstrategies/DET0868","analytics":[{"id":"AN2000","stix_id":"x-mitre-analytic--56622fce-489a-4ed9-b1fb-e525939667d4","name":"Analytic 2000","description":"Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet).","url":"https://attack.mitre.org/detectionstrategies/DET0868#AN2000","platforms":["PRE"],"log_source_references":[{"name":"Network Traffic","channel":"None","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"network-traffic"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0868"],"techniques":["T1595.003"]}],"live":true,"version":"1.0","techniques":["T1595.003"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}