{"id":"1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d","title":"PUA - Advanced IP/Port Scanner Update Check","description":"Detect the update check performed by Advanced IP/Port Scanner utilities.","author":"Axel Olsson","status":"test","level":"medium","date":"2022-08-14","modified":"2024-02-15","tags":["attack.discovery","attack.reconnaissance","attack.t1590"],"technique_ids":["T1590"],"logsource":{"category":"proxy"},"falsepositives":["Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement."],"references":["https://www.advanced-ip-scanner.com/","https://www.advanced-port-scanner.com/"],"source_path":"rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml","source_sha256":"6c3b1ff33588b273b4b19e934562e4a1d62bea279bc9a6bb25cf1fa413a0cecd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Advanced IP/Port Scanner Update Check\nid: 1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d\nstatus: test\ndescription: Detect the update check performed by Advanced IP/Port Scanner utilities.\nreferences:\n    - https://www.advanced-ip-scanner.com/\n    - https://www.advanced-port-scanner.com/\nauthor: Axel Olsson\ndate: 2022-08-14\nmodified: 2024-02-15\ntags:\n    - attack.discovery\n    - attack.reconnaissance\n    - attack.t1590\nlogsource:\n    category: proxy\ndetection:\n    selection:\n      # Example request: http://www.advanced-port-scanner.com/checkupdate.php?lng=en&ver=2-5-3680&beta=n&type=upd&rmode=p&product=aps\n      # Example request2: http://www.advanced-ip-scanner.com/checkupdate.php?lng=en&ver=2-5-3499&beta=n&type=upd&rmode=p&product=aips\n        c-uri|contains: '/checkupdate.php'\n        c-uri-query|contains|all:\n            - 'lng='\n            - 'ver='\n            - 'beta='\n            - 'type='\n            - 'rmode='\n            - 'product='\n    condition: selection\nfalsepositives:\n    - Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1590","id":"T1590","name":"Gather Victim Network Information","page":"techniques/enterprise/T1590/"}],"data_path":"data/detection-rules/1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d.json","kind":"sigma"}