Sigma medium test sigma

PUA - Advanced IP/Port Scanner Update Check

Detect the update check performed by Advanced IP/Port Scanner utilities.

View Source

Detection Logic

{
  "selection": {
    "c-uri
| contains": "/checkupdate.php",
    "c-uri-query
| contains
| all": [
      "lng=",
      "ver=",
      "beta=",
      "type=",
      "rmode=",
      "product="
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.

Field Validations

Loading…

Comments (0)

Loading comments...