PUA Tool Update Check to /checkupdate.php (Advanced IP/Port Scanner) via Proxy
Identifies proxy HTTP requests to /checkupdate.php from Advanced IP/Port Scanner with expected update-check query parameters.
- Category
- proxy
- Author
- Axel Olsson (SigmaHQ), DRL 1.1
- Published
- 2022-08-14
- Updated
- 2026-07-31
ATT&CK techniques
ReconResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies HTTP proxy requests whose URI contains /checkupdate.php and includes a query string with lng, ver, beta, type, rmode, and product parameters, consistent with an Advanced IP/Port Scanner update check. Such update-check traffic can be used to support reconnaissance tooling by keeping the utility current while it performs scanning. Detection relies on proxy logs capturing the full request URI and query parameters.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PUA Tool Update Check to /checkupdate.php (Advanced IP/Port Scanner) via Proxy
id: 120f7e64-f830-44c3-8b9b-cfcdf1fd7dd5
status: test
description: This rule identifies HTTP proxy requests whose URI contains /checkupdate.php and includes a query string with lng, ver, beta, type, rmode, and product parameters, consistent with an Advanced IP/Port Scanner update check. Such update-check traffic can be used to support reconnaissance tooling by keeping the utility current while it performs scanning. Detection relies on proxy logs capturing the full request URI and query parameters.
references:
- https://www.advanced-ip-scanner.com/
- https://www.advanced-port-scanner.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml
author: Axel Olsson, Huntrule Team
date: 2022-08-14
modified: 2024-02-15
tags:
- attack.discovery
- attack.reconnaissance
- attack.t1590
logsource:
category: proxy
detection:
selection:
c-uri|contains: /checkupdate.php
c-uri-query|contains|all:
- lng=
- ver=
- beta=
- type=
- rmode=
- product=
condition: selection
falsepositives:
- Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.
level: medium
license: DRL-1.1
related:
- id: 1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d
type: derived