Windows: Advanced IP Scanner (PUA) Execution via Process Creation
Identifies Windows processes running Advanced IP Scanner using filename/description and command-line arguments.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy (SigmaHQ), DRL 1.1
- Published
- 2020-05-12
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of Advanced IP Scanner by matching process image/original filename and descriptive strings associated with the tool. Attackers may use it to quickly discover hosts and services on a local network, which can support later access or lateral movement. It relies on Windows process creation telemetry, including the image path/filename, original filename, and command-line parameters.
Reporting behind it
- news.sophos.comhttps://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- labs.f-secure.comhttps://labs.f-secure.com/blog/prelude-to-ransomware-systembc
- assets.documentcloud.orghttps://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
- thedfirreport.comhttps://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
- github.comhttps://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Advanced IP Scanner (PUA) Execution via Process Creation"
id: f4be591a-1430-4350-85c4-add73e1ab378
status: test
description: This rule flags execution of Advanced IP Scanner by matching process image/original filename and descriptive strings associated with the tool. Attackers may use it to quickly discover hosts and services on a local network, which can support later access or lateral movement. It relies on Windows process creation telemetry, including the image path/filename, original filename, and command-line parameters.
references:
- https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://labs.f-secure.com/blog/prelude-to-ransomware-systembc
- https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
- https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml
author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy, Huntrule Team
date: 2020-05-12
modified: 2023-02-07
tags:
- attack.discovery
- attack.t1046
- attack.t1135
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|contains: \advanced_ip_scanner
- OriginalFileName|contains: advanced_ip_scanner
- Description|contains: Advanced IP Scanner
selection_cli:
CommandLine|contains|all:
- /portable
- /lng
condition: 1 of selection_*
falsepositives:
- Legitimate administrative use
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/info.yml
license: DRL-1.1
related:
- id: bef37fa2-f205-4a7b-b484-0759bfd5f86f
type: derived