Anvilogic low experimental other

Advanced IP Scanner Execution [snowflake-crowdstrikefdr_process]

Advanced IP Scanner is a legitimate utility that can perform network scanning. Several threat actors, including UNC2465, Conti, Pysa ransomware and FIN12, have been reported to use Advanced IP Scanner during reconnaissance activities. -- Threat Actor Association: FIN12, UNC2465 - Software Association: Akira, AvosLocker, Conti, Pysa

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and process_path ilike '%advanced_ip_scanner%' or regexp_like(process, '.*/portable.+/lng.*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...