The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. These legitimate administrative tools are often leveraged by threat actors and ransomware operators during the discovery phase to enumerate active hosts and open ports within a target environment. Detection is based on process creation telemetry referencing known executable names, original file names, or specific command-line parameters such as "/portable" and "/lng" that are characteristic of these tools. If confirmed malicious, this activity may indicate internal reconnaissance aimed at identifying reachable systems or services prior to lateral movement or further post-compromise actions.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.