Advanced IP Scanner Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•37

Detects the execution of Advanced IP Scanner, a tool often used by ransomware groups for network discovery. The rule identifies the tool by its image name, original file name, description, or specific command-line arguments indicating portable execution.