Advanced Port Scanner Execution (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Advanced Port Scanner is a free network scanner that allows users to quickly find open ports on network computers and retrieve versions of programs running on the ports it detects. Threat actors using Rhysida ransomware have been reported to use Advanced Port Scanner during reconnaissance activities.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1046` Network Service Discovery

References

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: '25757.47714'
title: Advanced Port Scanner Execution
description: Advanced Port Scanner is a free network scanner that allows users to
  quickly find open ports on network computers and retrieve versions of programs running
  on the ports it detects. Threat actors using Rhysida ransomware have been reported
  to use Advanced Port Scanner during reconnaissance activities.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "advanced_port_scanner.exe" | where match(process_name,
  "(?i)advanced_port_scanner\.exe") | table _time, host, user, process, process_*,
  parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows event logs
references:
- https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/rhysida-ransomware-intrusion.pdf?utm_source=blog&utm_medium=blog&utm_campaign=rhysida-ransomware
- https://www.advanced-port-scanner.com/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "advanced_port_scanner.exe"

Stage 2: `where`

| where match(process_name, "(?i)advanced_port_scanner\.exe")

Stage 3: `table`

| table _time, host, user, process, process_*, parent_process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`process_name`	regex_match	`"(?i)advanced_port_scanner.exe"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4688<"`
1	`"advanced_port_scanner.exe"`