Newly Seen Commonly Abused Network Scanner

Identifies newly observed execution of SoftPerfect Network Scanner or Advanced IP/Port Scanner on a Windows host. Adversaries commonly use these legitimate scanners during post-compromise discovery to map live hosts, open ports, and reachable systems, then select targets for lateral movement.

Rule type: new_terms
Rule indices:

  • logs-crowdstrike.fdr*
  • logs-endpoint.events.process-*
  • logs-m365_defender.event-*
  • logs-sentinel_one_cloud_funnel.*
  • logs-system.security*
  • logs-windows.forwarded*
  • logs-windows.sysmon_operational-*
  • winlogbeat-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Platform: Windows
  • Use Case: Threat Detection
  • Tactic: Discovery
  • Rule Type: New Terms
  • Data Source: Elastic Defend
  • Data Source: Windows Security Event Logs
  • Data Source: Microsoft Defender XDR
  • Data Source: Sysmon
  • Data Source: SentinelOne
  • Data Source: Crowdstrike

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

event.category:process and host.os.type:windows and event.type:start and
(
  process.name.caseless:(
    netscan*.exe or advanced_ip_scanner*.exe or
    advanced_ip_scanner_console.exe or advanced_port_scanner.exe
  ) or
  process.pe.original_file_name : (
    "advanced_ip_scanner.exe" or
    "advanced_port_scanner.exe" or
    "advanced_ip_scanner_console.exe"
  )
)

Framework: MITRE ATT&CK