PUA - Advanced IP Scanner Execution

Title: PUA - Advanced IP Scanner Execution
Status: test
Description:Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
References:
  -https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
  -https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
  -https://labs.f-secure.com/blog/prelude-to-ransomware-systembc
  -https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
  -https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
  -https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner
Author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy
Date: 2020-05-12
modified:2023-02-07
Tags:

• -'attack.discovery'
• -'attack.t1046'
• -'attack.t1135'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|contains:'\advanced_ip_scanner' OriginalFileName|contains:'advanced_ip_scanner' Description|contains:'Advanced IP Scanner'   selection_cli:
    CommandLine|contains|all:
      -'/portable'
      -'/lng'

  condition:1 of selection_*
Falsepositives:
  -Legitimate administrative use
Level: medium