{"id":"bef37fa2-f205-4a7b-b484-0759bfd5f86f","title":"PUA - Advanced IP Scanner Execution","description":"Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.","author":"Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy","status":"test","level":"medium","date":"2020-05-12","modified":"2023-02-07","tags":["attack.discovery","attack.t1046","attack.t1135"],"technique_ids":["T1046","T1135"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administrative use"],"references":["https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/","https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html","https://labs.f-secure.com/blog/prelude-to-ransomware-systembc","https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf","https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer","https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml","source_sha256":"57494319b11b4cb2ee1f12d7e1318ea9031288c5fbb1f8340dc6ecb0b8dc3a64","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Advanced IP Scanner Execution\nid: bef37fa2-f205-4a7b-b484-0759bfd5f86f\nstatus: test\ndescription: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.\nreferences:\n    - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/\n    - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html\n    - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc\n    - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf\n    - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer\n    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner\nauthor: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy\ndate: 2020-05-12\nmodified: 2023-02-07\ntags:\n    - attack.discovery\n    - attack.t1046\n    - attack.t1135\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|contains: '\\advanced_ip_scanner' # Covers also advanced_ip_scanner_console.exe\n        - OriginalFileName|contains: 'advanced_ip_scanner' # Covers also advanced_ip_scanner_console.exe\n        - Description|contains: 'Advanced IP Scanner'\n    selection_cli:\n        CommandLine|contains|all:\n            - '/portable'\n            - '/lng'\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate administrative use\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","page":"techniques/enterprise/T1046/"},{"key":"enterprise/T1135","id":"T1135","name":"Network Share Discovery","page":"techniques/enterprise/T1135/"}],"data_path":"data/detection-rules/bef37fa2-f205-4a7b-b484-0759bfd5f86f.json","kind":"sigma"}