Windows Process Creation: NimScan.exe Execution via Known File Hashes

Alerts on Windows execution of NimScan.exe when process image and known IMPHASH values match.

FreeUnreviewedSigmamediumv1

windows-process-creation-nimscan-exe-execution-via-known-file-hashes-4fd6b1c7

title: "Windows Process Creation: NimScan.exe Execution via Known File Hashes"
id: 74c5071f-6c27-4b61-b5ee-8d27fe8d80a1
status: test
description: This rule flags execution of the NimScan port-scanning utility on Windows when the process image ends with NimScan.exe and the event includes one of the listed IMPHASH values. Port scanning in a compromised environment is a common reconnaissance step used to identify reachable services and inform follow-on activity. The detection relies on Windows process creation telemetry and matching process image name plus specific file hash indicators.
references:
  - https://x.com/cyberfeeddigest/status/1887041526397587859
  - https://github.com/elddy/NimScan
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_nimscan.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \NimScan.exe
    - Hashes|contains:
        - IMPHASH=41BB1C7571B3A724EB83A1D2B96DBB8C
        - IMPHASH=B1B6ADACB172795480179EFD18A29549
        - IMPHASH=0D1F896DC7642AD8384F9042F30279C2
  condition: selection
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: 4fd6b1c7-19b8-4488-97f6-00f0924991a3
    type: derived

What it detects

This rule flags execution of the NimScan port-scanning utility on Windows when the process image ends with NimScan.exe and the event includes one of the listed IMPHASH values. Port scanning in a compromised environment is a common reconnaissance step used to identify reachable services and inform follow-on activity. The detection relies on Windows process creation telemetry and matching process image name plus specific file hash indicators.

Known false positives

Legitimate administrator activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.