huntrule

PUA Tool Update Check to /checkupdate.php (Advanced IP/Port Scanner) via Proxy

Identifies proxy HTTP requests to /checkupdate.php from Advanced IP/Port Scanner with expected update-check query parameters.

FreeReviewedSigma · Medium · v2
Category
proxy
Author
Axel Olsson (SigmaHQ), DRL 1.1
Published
2022-08-14
Updated
2026-07-31
AnalysisDetection
title: PUA Tool Update Check to /checkupdate.php (Advanced IP/Port Scanner) via Proxy
id: 120f7e64-f830-44c3-8b9b-cfcdf1fd7dd5
status: test
description: This rule identifies HTTP proxy requests whose URI contains /checkupdate.php and includes a query string with lng, ver, beta, type, rmode, and product parameters, consistent with an Advanced IP/Port Scanner update check. Such update-check traffic can be used to support reconnaissance tooling by keeping the utility current while it performs scanning. Detection relies on proxy logs capturing the full request URI and query parameters.
references:
  - https://www.advanced-ip-scanner.com/
  - https://www.advanced-port-scanner.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml
author: Axel Olsson, Huntrule Team
date: 2022-08-14
modified: 2024-02-15
tags:
  - attack.discovery
  - attack.reconnaissance
  - attack.t1590
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: /checkupdate.php
    c-uri-query|contains|all:
      - lng=
      - ver=
      - beta=
      - type=
      - rmode=
      - product=
  condition: selection
falsepositives:
  - Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.
level: medium
license: DRL-1.1
related:
  - id: 1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d
    type: derived