Active Internet Scans Targeting Hikvision Intelligent Security API: Detection and Defense

---
title: Hikvision ISAPI Intelligent Security API Probe
id: 89c5d234-1a3b-4c5d-9e6f-1a2b3c4d5e6f
status: experimental
description: Detects reconnaissance attempts probing Hikvision Intelligent Security API endpoints (ISAPI).
references:
  - https://isc.sans.edu/diary/33164
author: Security Arsenal
date: 2026/07/20
tags:
  - attack.reconnaissance
  - attack.t1595
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection:
    c-uri|contains:
      - '/ISAPI/Security/'
      - '/ISAPI/System/'
      - '/ISAPI/Event/notification/'
  condition: selection
falsepositives:
  - Legitimate administrative access from internal subnets
level: medium
---
title: High Frequency Hikvision API Scanning
id: 77a4b1c2-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects high-frequency requests to Hikvision API paths indicative of automated scanning tools.
references:
  - https://isc.sans.edu/diary/33164
author: Security Arsenal
date: 2026/07/20
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: nginx
detection:
  selection_uri:
    c-uri|contains: '/ISAPI/'
  filter_legit:
    c-ip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  timeframe: 1m
  condition: selection_uri | count() by c-ip > 10 and not filter_legit
falsepositives:
  - Authorized internal configuration backups
level: high

// Hunt for Hikvision ISAPI probing in Syslog/CEF or CommonSecurityLog
Syslog
| where SyslogMessage contains "/ISAPI/" 
| extend RequestPath = extract(@"GET\s+(\/ISAPI\/[^\s]+)", 1, SyslogMessage)
| summarize count() by RequestPath, SourceIP, bin(TimeGenerated, 5m)
| where count_ > 5
| order by count_ desc 
| project TimeGenerated, SourceIP, RequestPath, count_

-- Hunt for established connections on common Hikvision ports
-- This identifies potential active management or callback connections
SELECT Fd, Family, State, RemoteAddr, RemotePort, Pid
FROM listen_sockets()
WHERE RemotePort IN (80, 443, 554, 8000, 8080)
   AND State == 'ESTABLISHED'
   AND RemoteAddr NOT IN ['127.0.0.1', '::1', '0.0.0.0']

<#
.SYNOPSIS
    Scans the local subnet for devices responding with Hikvision web headers to identify exposed assets.
.DESCRIPTION
    This script attempts to identify Hikvision devices on the local network by checking HTTP headers.
    Use only on networks you are authorized to audit.
#>

$Subnet = "192.168.1" # Update to your local subnet prefix
$Ports = @(80, 443, 8080, 8000)

Write-Host "Scanning for Hikvision devices..."

1..254 | ForEach-Object {
    $IP = "$Subnet.$_"
    foreach ($Port in $Ports) {
        try {
            $TcpClient = New-Object System.Net.Sockets.TcpClient
            $Connect = $TcpClient.BeginConnect($IP, $Port, $null, $null)
            $Wait = $Connect.AsyncWaitHandle.WaitOne(200, $false)
            if ($Wait) {
                $TcpClient.EndConnect($Connect)
                # Quick HTTP Header Check
                try {
                    $Response = Invoke-WebRequest -Uri "http://$IP`:$Port" -Method Head -TimeoutSec 2 -ErrorAction SilentlyContinue
                    if ($Response.Headers['Server'] -like '*Hikvision*' -or $Response.Headers['Server'] -like '*Webs*') {
                        Write-Host "[ALERT] Hikvision Device Found: $IP`:$Port - $($Response.Headers['Server'])" -ForegroundColor Red
                    }
                } catch {
                    # Ignore HTTP errors, port was open
                }
            }
            $TcpClient.Close()
        } catch {
            # Port closed or filtered
        }
    }
}
Write-Host "Scan complete."