PUA - Advanced IP/Port Scanner Update Check

Title: PUA - Advanced IP/Port Scanner Update Check
Status: test
Description:Detect the update check performed by Advanced IP/Port Scanner utilities.
References:
  -https://www.advanced-ip-scanner.com/
  -https://www.advanced-port-scanner.com/
Author: Axel Olsson
Date: 2022-08-14
modified:2024-02-15
Tags:

• -'attack.discovery'
• -'attack.reconnaissance'
• -'attack.t1590'

Logsource:

• category: proxy

Detection:
  selection:
    c-uri|contains: '/checkupdate.php'
    c-uri-query|contains|all:
      -'lng='
      -'ver='
      -'beta='
      -'type='
      -'rmode='
      -'product='

  condition:selection
Falsepositives:
  -Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.
Level: medium