{"id":"f8ad2e2c-40b6-4117-84d7-20b89896ab23","title":"Suspicious Scan Loop Network","description":"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system","author":"frack113","status":"test","level":"medium","date":"2022-03-12","modified":"","tags":["attack.execution","attack.t1059","attack.discovery","attack.t1018"],"technique_ids":["T1018","T1059"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate script"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md","https://ss64.com/nt/for.html","https://ss64.com/ps/foreach-object.html"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml","source_sha256":"0180b0d56cd33a57944aff1ec7d055d4be95ce99ccbda37aeeaba7cb1d886e9f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Scan Loop Network\nid: f8ad2e2c-40b6-4117-84d7-20b89896ab23\nstatus: test\ndescription: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md\n    - https://ss64.com/nt/for.html\n    - https://ss64.com/ps/foreach-object.html\nauthor: frack113\ndate: 2022-03-12\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.discovery\n    - attack.t1018\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_loop:\n        CommandLine|contains:\n            - 'for '\n            - 'foreach '\n    selection_tools:\n        CommandLine|contains:\n            - 'nslookup'\n            - 'ping'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate script\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"},{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/f8ad2e2c-40b6-4117-84d7-20b89896ab23.json","kind":"sigma"}