Advanced IP Scanner Execution (Sysmon)

id: '20033.35681'
title: Advanced IP Scanner Execution
description: 'Advanced IP Scanner is a legitimate utility that can perform network
  scanning. Several threat actors, including UNC2465, Conti, Pysa ransomware and FIN12,
  have been reported to use Advanced IP Scanner during reconnaissance activities.
  -- Threat Actor Association: FIN12, UNC2465 - Software Association: Akira, AvosLocker,
  Conti, Pysa'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR Type=Process) "advanced_ip_scanner" OR (TERM(/portable) TERM(/lng)) | where match(process_name,
  "(?i)advanced_ip_scanner") OR match(process, "(?i)\sportable/s.+\slng") | table
  _time, host, user, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox
- https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-destructive-pysa-ransomware
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
- https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/
- https://www.mandiant.com/resources/blog/shining-a-light-on-darkside-ransomware-operations