Query: rule covering Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Matching passage: Sigma rule: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.. Logsource: windows / process_creation. Rule: title: PUA - Advanced IP Scanner Execution id: bef37fa2-f205-4a7b-b484-0759bfd5f86f status: test description: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups. references: - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/ - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy date: 2020-05-12 modified: 2023-02-07 tags: - attack.discovery - attack.t1046 - attack.t1135 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \advanced_ip_scanner - OriginalFileName|contains: advanced_ip_scanner - Description|contains: Advanced IP Scanner selection_cli: CommandLine|contains|all: - /portable - /lng condition: 1 of selection_* falsepositives: - Legitimate administrative use level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/info.yml
Near-miss passage: Sigma rule: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential. Logsource: windows / image_load. Rule: title: CredUI.DLL Loaded By Uncommon Process id: 9ae01559-cf7e-4f8e-8e14-4c290a1b4784 status: test description: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW". references: - https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password - https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/S12cybersecurity/RDPCredentialStealer author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2026-06-29 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: category: image_load product: windows detection: selection: - ImageLoaded|endswith: - \credui.dll - \wincredui.dll - OriginalFileName: - credui.dll - wincredui.dll filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\SystemApps\ filter_main_full: Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\regedit.exe filter_optional_opera: Image|endswith: \opera_autoupdate.exe filter_optional_process_explorer: Image|endswith: - \procexp64.exe - \procexp64a.exe - \procexp.exe filter_optional_teams: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\Teams\ Image|endswith: \Teams.exe filter_optional_onedrive: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate processes loading those DLLs in your environment. level: medium