fscan Internal Network Scanner Renamed as sys.log or mail.log

Duo Tech@duotech

•updated Jul 27, 2026•4•0•4

Detects execution of the fscan internal network reconnaissance scanner renamed as sys.log or mail.log, or process command lines invoking the actual fscan CLI binary with its characteristic flags, as used by JadeProx operators for post-compromise internal network scanning.