Advanced Port Scanner Execution (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Advanced Port Scanner is a free network scanner that allows users to quickly find open ports on network computers and retrieve versions of programs running on the ports it detects. Threat actors using Rhysida ransomware have been reported to use Advanced Port Scanner during reconnaissance activities.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1046` Network Service Discovery

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '25757.47718'
title: Advanced Port Scanner Execution
description: Advanced Port Scanner is a free network scanner that allows users to
  quickly find open ports on network computers and retrieve versions of programs running
  on the ports it detects. Threat actors using Rhysida ransomware have been reported
  to use Advanced Port Scanner during reconnaissance activities.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  ) "advanced_port_scanner.exe" | where match(process_name, "(?i)advanced_port_scanner\.exe")
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows Sysmon
references:
- https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/rhysida-ransomware-intrusion.pdf?utm_source=blog&utm_medium=blog&utm_campaign=rhysida-ransomware
- https://www.advanced-port-scanner.com/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<" ) "advanced_port_scanner.exe"

Stage 2: `where`

| where match(process_name, "(?i)advanced_port_scanner\.exe")

Stage 3: `table`

| table _time, host, user, process, process_*, parent_process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process_name`	regex_match	`"(?i)advanced_port_scanner.exe"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`"advanced_port_scanner.exe"`