Advanced IP/Port Scanner update check over HTTP proxy

title: Advanced IP/Port Scanner update check over HTTP proxy
id: 120f7e64-f830-44c3-8b9b-cfcdf1fd7dd5
status: test
description: This rule flags outbound HTTP requests to Advanced IP/Port Scanner update endpoints, specifically requests containing /checkupdate.php with expected query parameters (lng, ver, beta, type, rmode, product). Attackers can use scanner software or similar components to perform discovery and stage further activity, so update-check traffic can be an indicator of tool usage. Detection relies on proxy telemetry capturing the full requested URI and query string parameters.
references:
  - https://www.advanced-ip-scanner.com/
  - https://www.advanced-port-scanner.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml
author: Axel Olsson, Huntrule Team
date: 2022-08-14
modified: 2024-02-15
tags:
  - attack.discovery
  - attack.reconnaissance
  - attack.t1590
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: /checkupdate.php
    c-uri-query|contains|all:
      - lng=
      - ver=
      - beta=
      - type=
      - rmode=
      - product=
  condition: selection
falsepositives:
  - Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.
level: medium
license: DRL-1.1
related:
  - id: 1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d
    type: derived