Title:
PUA - Advanced Port Scanner Execution
Status:
test
Description:Detects the use of Advanced Port Scanner.
References:
-https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-18
modified:2023-02-07
Tags:
- -'attack.discovery'
- -'attack.t1046'
- -'attack.t1135'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
Image|contains:
'\advanced_port_scanner'
OriginalFileName|contains:
'advanced_port_scanner'
Description|contains:
'Advanced Port Scanner'
selection_cli:
CommandLine|contains|all:
-'/portable'
-'/lng'
condition:
1 of selection_*
Falsepositives:
-Legitimate administrative use
-Tools with similar commandline (very rare)
Level:
medium
