{"id":"ca387a8e-1c84-4da3-9993-028b45342d30","title":"PUA - SoftPerfect Netscan Execution","description":"Detects usage of SoftPerfect's \"netscan.exe\". An application for scanning networks.\nIt is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.\n","author":"@d4ns4n_ (Wuerth-Phoenix)","status":"test","level":"medium","date":"2024-04-25","modified":"","tags":["attack.discovery","attack.t1046"],"technique_ids":["T1046"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administrator activity"],"references":["https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/","https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf","https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue","https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/","https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/","https://www.softperfect.com/products/networkscanner/"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_netscan.yml","source_sha256":"678f274ca377c843c7d69a1b59a1915adefeaf95b5c6d6f107d0e9bd8f0e27ba","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_netscan.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - SoftPerfect Netscan Execution\nid: ca387a8e-1c84-4da3-9993-028b45342d30\nstatus: test\ndescription: |\n    Detects usage of SoftPerfect's \"netscan.exe\". An application for scanning networks.\n    It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.\nreferences:\n    - https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/\n    - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf\n    - https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue\n    - https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/\n    - https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/\n    - https://www.softperfect.com/products/networkscanner/\nauthor: '@d4ns4n_ (Wuerth-Phoenix)'\ndate: 2024-04-25\ntags:\n    - attack.discovery\n    - attack.t1046\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\netscan.exe'\n        - Product: 'Network Scanner'\n        - Description: 'Application for scanning networks'\n    condition: selection\nfalsepositives:\n    - Legitimate administrator activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","page":"techniques/enterprise/T1046/"}],"data_path":"data/detection-rules/ca387a8e-1c84-4da3-9993-028b45342d30.json","kind":"sigma"}