Advanced IP Scanner - File Event

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•33

Detects the creation of temporary files associated with Advanced IP Scanner, a tool often used by ransomware groups for network discovery. This rule specifically looks for the creation of files within the user's temporary directory that contain the string '\AppData\Local\Temp\Advanced IP Scanner 2'.