Auto-generated rule on file ipscan.exe

Hunt Hypothesis

This detection identifies the execution of ipscan.exe, a utility often leveraged by adversaries during network reconnaissance to map internal hosts and identify potential lateral movement paths. Proactively hunting for this activity in Azure Sentinel is essential to distinguish legitimate administrative scanning from malicious enumeration that could precede broader compromise or data exfiltration attempts.

YARA Rule

rule Angry_IP_Scanner_v2_08_ipscan {
	meta:
		description = "Auto-generated rule on file ipscan.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "70cf2c09776a29c3e837cb79d291514a"
	strings:
		$s0 = "_H/EnumDisplay/"
		$s5 = "ECTED.MSVCRT0x"
		$s8 = "NotSupported7"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ipscan.exe detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus Scheduled Scans

  • Context: The Windows Defender service (Antimalware Service Executable) periodically launches ipscan.exe (often part of the Network Inspection or Active Directory scanning modules) to perform routine network health checks. This occurs automatically at 02:00 AM daily on all domain-joined endpoints.
  • Filter/Exclusion: Exclude processes where the parent process is MsMpEng.exe and the command line contains arguments related to “scheduled scan” or “network inspection.” Alternatively, whitelist the file path C:\Program Files\Microsoft Defender Antivirus\bin\ipscan.exe.

• Scenario: Group Policy Object (GPO) Deployment of Network Tools

  • Context: During a scheduled GPO refresh window (e.g., every Tuesday at 08:00 AM), the System account (NT AUTHORITY\SYSTEM) executes ipscan.exe to validate network connectivity and update IP address assignments for new workstation onboarding scripts.
  • Filter/Exclusion: Create an exclusion rule for events where the User Account is SYSTEM AND the Process Path matches C:\Windows\System32\GroupPolicy\Machine\ipscan.exe.

• Scenario: Third-Party Asset Management Agent Execution

  • Context: Enterprise asset management tools like SolarWinds RMM or Ivanti Neurons utilize a local agent that invokes ipscan.exe to inventory network devices and verify IP configurations during their hourly heartbeat cycle.
  • Filter/Exclusion: Filter out alerts where the parent process is identified as SolarWinds.Agent.Service.exe or ivantiservice.exe. Additionally, exclude