Advanced IP Scanner Execution from Temp Folder via Windows File Events
Flags file activity targeting Advanced IP Scanner 2 under a Windows user Temp directory.
- Product
- windows
- Category
- file_event
- Author
- @ROxPinTeddy (SigmaHQ), DRL 1.1
- Published
- 2020-05-12
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file events where a file name contains the path segment for Advanced IP Scanner 2 within the user Temp directory (\AppData\Local\Temp\Advanced IP Scanner 2). Attackers and administrators may use network discovery tools, so locating this specific binary in a transient user-writable location can indicate automated tool staging. It relies on Windows file event telemetry that includes TargetFilename so the rule can match the specified substring.
Reporting behind it
- news.sophos.comhttps://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- labs.f-secure.comhttps://labs.f-secure.com/blog/prelude-to-ransomware-systembc
- assets.documentcloud.orghttps://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
- thedfirreport.comhttps://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Advanced IP Scanner Execution from Temp Folder via Windows File Events
id: 7f0c1851-9e67-4417-a2fb-05ebe0673215
related:
- id: bef37fa2-f205-4a7b-b484-0759bfd5f86f
type: derived
- id: fed85bf9-e075-4280-9159-fbe8a023d6fa
type: derived
status: test
description: This rule flags file events where a file name contains the path segment for Advanced IP Scanner 2 within the user Temp directory (\AppData\Local\Temp\Advanced IP Scanner 2). Attackers and administrators may use network discovery tools, so locating this specific binary in a transient user-writable location can indicate automated tool staging. It relies on Windows file event telemetry that includes TargetFilename so the rule can match the specified substring.
references:
- https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://labs.f-secure.com/blog/prelude-to-ransomware-systembc
- https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml
author: "@ROxPinTeddy, Huntrule Team"
date: 2020-05-12
modified: 2022-11-29
tags:
- attack.discovery
- attack.t1046
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: \AppData\Local\Temp\Advanced IP Scanner 2
condition: selection
falsepositives:
- Legitimate administrative use
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_advanced_ip_scanner/info.yml
license: DRL-1.1