Anvilogic low experimental other
Advanced Port Scanner Execution [snowflake-crowdstrikefdr_process]
Advanced Port Scanner is a free network scanner that allows users to quickly find open ports on network computers and retrieve versions of programs running on the ports it detects. Threat actors using Rhysida ransomware have been reported to use Advanced Port Scanner during reconnaissance activities.
Detection Logic
select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and process_path ilike '%advanced_port_scanner.exe'Field Validations
Loading…
Comments (0)
Loading comments...