huntrule

Windows Process Creation: NimScan.exe Execution via Known File Hashes

Alerts on Windows execution of NimScan.exe when process image and known IMPHASH values match.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-02-05
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags execution of the NimScan port-scanning utility on Windows when the process image ends with NimScan.exe and the event includes one of the listed IMPHASH values. Port scanning in a compromised environment is a common reconnaissance step used to identify reachable services and inform follow-on activity. The detection relies on Windows process creation telemetry and matching process image name plus specific file hash indicators.

Reporting behind it

Related detections9 linkedT1046 — drag to rearrange
Suspicious Fscan Internal Network Scanner Execution (via process_creation)
Possible Network Service Scanning via Nmap or Masscan (via process_creation)
Malicious Anonymous Login - Domain Specified (via security)
Suspicious Network Scanning Tool Execution
Malicious RDP Discovery Performed on Multiple Hosts (via rdp)
Malicious Anonymous Access Performed to Multiple Targets (via security)
Malicious Network Login Performed to Multiple Targets (via security)
Suspicious SoftPerfect Network Scanner Execution for Discovery
Suspicious SoftPerfect Network Scanner Execution (via process_creation)
Windows Process Creation: NimScan.exe Execution via Known File Hashes
Pivot detection · T1046 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.