Detection rules › Sigma

PUA - SoftPerfect Netscan Execution

Severity
medium
Author
@d4ns4n_ (Wuerth-Phoenix)
Source
upstream

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1046 Network Service Discovery

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: selection

or:
Description: 'Application for scanning networks'
Image|endswith: '\netscan.exe'
Product: 'Network Scanner'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Descriptioneq
  • Application for scanning networks
Imageends_with
  • \netscan.exe
Producteq
  • Network Scanner