---
title: Newly Seen Commonly Abused Network Scanner
description: Identifies newly observed execution of SoftPerfect Network Scanner or Advanced IP/Port Scanner on a Windows host. Adversaries commonly use these legitimate...
url: https://www.elastic.co/elastic/docs-builder/docs/4075/reference/security/prebuilt-rules/rules/windows/discovery_newly_seen_abused_scanners
products:
  - Elastic Security
---

# Newly Seen Commonly Abused Network Scanner
Identifies newly observed execution of SoftPerfect Network Scanner or Advanced IP/Port Scanner on a Windows host.
Adversaries commonly use these legitimate scanners during post-compromise discovery to map live hosts, open ports, and
reachable systems, then select targets for lateral movement.
**Rule type**: new_terms
**Rule indices**:
- logs-crowdstrike.fdr*
- logs-endpoint.events.process-*
- logs-m365_defender.event-*
- logs-sentinel_one_cloud_funnel.*
- logs-system.security*
- logs-windows.forwarded*
- logs-windows.sysmon_operational-*
- winlogbeat-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a)
- [[https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/](https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/)](https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/)
- [[https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/](https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/)](https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/)
- [[https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/](https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/)](https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/)
- [[https://www.cyfirma.com/news/weekly-intelligence-report-26-jan-2024/](https://www.cyfirma.com/news/weekly-intelligence-report-26-jan-2024/)](https://www.cyfirma.com/news/weekly-intelligence-report-26-jan-2024/)
- [[https://github.com/Securityinbits/defender-hunt-queries/blob/main/discovery-tools.md](https://github.com/Securityinbits/defender-hunt-queries/blob/main/discovery-tools.md)](https://github.com/Securityinbits/defender-hunt-queries/blob/main/discovery-tools.md)

**Tags**:
- Domain: Endpoint
- OS: Windows
- Platform: Windows
- Use Case: Threat Detection
- Tactic: Discovery
- Rule Type: New Terms
- Data Source: Elastic Defend
- Data Source: Windows Security Event Logs
- Data Source: Microsoft Defender XDR
- Data Source: Sysmon
- Data Source: SentinelOne
- Data Source: Crowdstrike
- Resources: Investigation Guide

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
Setup instructions: [https://ela.st/install-elastic-defend](https://ela.st/install-elastic-defend)

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)


## Investigation guide


## Triage and analysis> **Disclaimer**:
This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Newly Seen Commonly Abused Network Scanner

This rule detects the first observed execution of commonly abused network-scanning tools on a Windows host, which can signal post-compromise discovery activity. After gaining a foothold, an attacker may run a portable scanner across the local subnet to identify live systems and exposed SMB or RDP services, then prioritize targets for lateral movement.

### Possible investigation steps

- Validate the executable’s path, digital signature, hash reputation, download origin, command line, parent process, user account, and prevalence across the environment to distinguish authorized software from a renamed or portable copy.
- Correlate the execution with network telemetry to identify scanned address ranges, destination ports, connection volume, and whether sensitive systems or lateral-movement services such as SMB, RDP, WinRM, or SSH were targeted.
- Review nearby endpoint and identity activity for initial-access or post-compromise indicators, including suspicious downloads, archive extraction, PowerShell execution, credential access, remote logons, service creation, and scheduled tasks.
- Confirm with the host owner and IT teams whether the scanner and scope were approved, considering the user’s role, device purpose, execution time, and any related change or vulnerability-management activity.
- If unauthorized, isolate the host, preserve the binary and relevant telemetry, block confirmed malicious indicators, reset potentially exposed credentials, and investigate contacted systems for follow-on access.


### False positive analysis

- An authorized administrator may run the scanner for network inventory or connectivity troubleshooting; verify the user’s role, executable path and signature, scanned range, and any associated change record.
- An approved security assessment or vulnerability-management activity may execute the scanner on a newly provisioned or infrequently used Windows host; confirm the timing, source host, target scope, and authorization with the responsible team.


### Response and remediation

- Isolate the affected Windows host and restrict its access to scanned subnets and services such as SMB, RDP, WinRM, and SSH while preserving the scanner executable, command history, and relevant forensic evidence.
- Remove unauthorized scanner binaries and attacker persistence, including suspicious scheduled tasks, services, startup entries, PowerShell scripts, remote-management tools, and newly created accounts.
- Reset credentials used on the compromised host, revoke active sessions and tokens, and investigate contacted systems for remote logons, service creation, administrative shares, or other lateral-movement activity.
- Escalate immediately to incident response if scanning reached sensitive systems, privileged credentials may be exposed, or follow-on access appears on another host, and expand containment to all affected accounts and endpoints.
- Reimage or restore compromised systems from a verified known-good baseline, patch exploited weaknesses, and validate endpoint protection, logging, and business functionality before reconnecting them.
- Block malicious file hashes and download sources, apply application control to unapproved portable scanners, restrict unnecessary east-west connectivity, and alert on future scanner execution or high-volume port probing.


## Rule Query

```kuery
event.category:process and host.os.type:windows and event.type:start and
(
  process.name.caseless:(
    netscan*.exe or advanced_ip_scanner*.exe or
    advanced_ip_scanner_console.exe or advanced_port_scanner.exe
  ) or
  process.pe.original_file_name : (
    "advanced_ip_scanner.exe" or
    "advanced_port_scanner.exe" or
    "advanced_ip_scanner_console.exe"
  )
)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
- Id: TA0007
- Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Remote System Discovery
- Id: T1018
- Reference URL: [[https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)](https://attack.mitre.org/techniques/T1018/)
- Technique:
  - Name: Network Service Discovery
- Id: T1046
- Reference URL: [[https://attack.mitre.org/techniques/T1046/](https://attack.mitre.org/techniques/T1046/)](https://attack.mitre.org/techniques/T1046/)