PUA - SoftPerfect Netscan Execution

calendar Aug 12, 2024 · attack.discovery attack.t1046  ·
Share on: linkedin copy

Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

Sigma rule (View on GitHub)

 1title: PUA - SoftPerfect Netscan Execution
 2id: ca387a8e-1c84-4da3-9993-028b45342d30
 3status: experimental
 4description: |
 5    Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
 6    It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.    
 7references:
 8    - https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/
 9    - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf
10    - https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
11    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue
12    - https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/
13    - https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/
14    - https://www.softperfect.com/products/networkscanner/
15author: '@d4ns4n_ (Wuerth-Phoenix)'
16date: 2024-04-25
17tags:
18    - attack.discovery
19    - attack.t1046
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        - Image|endswith: '\netscan.exe'
26        - Product: 'Network Scanner'
27        - Description: 'Application for scanning networks'
28    condition: selection
29falsepositives:
30    - Legitimate administrator activity
31level: medium

References

Related rules

to-top