Elastic Security Detection Rules

Newly Seen Commonly Abused Network Scanner

Last updated a month ago on 2026-09-15
Created 2 months ago on 2026-09-10

About

Identifies newly observed execution of SoftPerfect Network Scanner or Advanced IP/Port Scanner on a Windows host. Adversaries commonly use these legitimate scanners during post-compromise discovery to map live hosts, open ports, and reachable systems, then select targets for lateral movement.
Tags
Domain: EndpointOS: WindowsPlatform: WindowsUse Case: Threat DetectionTactic: DiscoveryRule Type: New TermsData Source: Elastic DefendData Source: Windows Security Event LogsData Source: Microsoft Defender XDRData Source: SysmonData Source: SentinelOneData Source: CrowdstrikeLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ Remote System Discovery (T1018)(external, opens in a new tab or window)

↳ Network Service Discovery (T1046)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-crowdstrike.fdr*logs-endpoint.events.process-*logs-m365_defender.event-*logs-sentinel_one_cloud_funnel.*logs-system.security*logs-windows.forwarded*logs-windows.sysmon_operational-*winlogbeat-*
Related Integrations

endpoint(external, opens in a new tab or window)

windows(external, opens in a new tab or window)

system(external, opens in a new tab or window)

m365_defender(external, opens in a new tab or window)

sentinel_one_cloud_funnel(external, opens in a new tab or window)

crowdstrike(external, opens in a new tab or window)

Query
text code block:
event.category:process and host.os.type:windows and event.type:start and
(
  process.name.caseless:(
    netscan*.exe or advanced_ip_scanner*.exe or
    advanced_ip_scanner_console.exe or advanced_port_scanner.exe
  ) or
  process.pe.original_file_name : (
    "advanced_ip_scanner.exe" or
    "advanced_port_scanner.exe" or
    "advanced_ip_scanner_console.exe"
  )
)

Install detection rules in Elastic Security

Detect Newly Seen Commonly Abused Network Scanner in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).