---
title: Newly Seen Commonly Abused Network Scanner
description: Identifies newly observed execution of SoftPerfect Network Scanner or Advanced IP/Port Scanner on a Windows host. Adversaries commonly use these legitimate...
url: https://www.elastic.co/elastic/docs-builder/docs/4089/reference/security/prebuilt-rules/rules/windows/discovery_newly_seen_abused_scanners
products:
  - Elastic Security
---

# Newly Seen Commonly Abused Network Scanner
Identifies newly observed execution of SoftPerfect Network Scanner or Advanced IP/Port Scanner on a Windows host.
Adversaries commonly use these legitimate scanners during post-compromise discovery to map live hosts, open ports, and
reachable systems, then select targets for lateral movement.
**Rule type**: new_terms
**Rule indices**:
- logs-crowdstrike.fdr*
- logs-endpoint.events.process-*
- logs-m365_defender.event-*
- logs-sentinel_one_cloud_funnel.*
- logs-system.security*
- logs-windows.forwarded*
- logs-windows.sysmon_operational-*
- winlogbeat-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a)
- [[https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/](https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/)](https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/)
- [[https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/](https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/)](https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/)
- [[https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/](https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/)](https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/)
- [[https://www.cyfirma.com/news/weekly-intelligence-report-26-jan-2024/](https://www.cyfirma.com/news/weekly-intelligence-report-26-jan-2024/)](https://www.cyfirma.com/news/weekly-intelligence-report-26-jan-2024/)
- [[https://github.com/Securityinbits/defender-hunt-queries/blob/main/discovery-tools.md](https://github.com/Securityinbits/defender-hunt-queries/blob/main/discovery-tools.md)](https://github.com/Securityinbits/defender-hunt-queries/blob/main/discovery-tools.md)

**Tags**:
- Domain: Endpoint
- OS: Windows
- Platform: Windows
- Use Case: Threat Detection
- Tactic: Discovery
- Rule Type: New Terms
- Data Source: Elastic Defend
- Data Source: Windows Security Event Logs
- Data Source: Microsoft Defender XDR
- Data Source: Sysmon
- Data Source: SentinelOne
- Data Source: Crowdstrike

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
Setup instructions: [https://ela.st/install-elastic-defend](https://ela.st/install-elastic-defend)

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)


## Rule Query

```kuery
event.category:process and host.os.type:windows and event.type:start and
(
  process.name.caseless:(
    netscan*.exe or advanced_ip_scanner*.exe or
    advanced_ip_scanner_console.exe or advanced_port_scanner.exe
  ) or
  process.pe.original_file_name : (
    "advanced_ip_scanner.exe" or
    "advanced_port_scanner.exe" or
    "advanced_ip_scanner_console.exe"
  )
)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
- Id: TA0007
- Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Remote System Discovery
- Id: T1018
- Reference URL: [[https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)](https://attack.mitre.org/techniques/T1018/)
- Technique:
  - Name: Network Service Discovery
- Id: T1046
- Reference URL: [[https://attack.mitre.org/techniques/T1046/](https://attack.mitre.org/techniques/T1046/)](https://attack.mitre.org/techniques/T1046/)