Auto-generated rule on file ipscan.exe

Hunt Hypothesis

This detection identifies the execution of ipscan.exe, a utility often leveraged by adversaries during network reconnaissance to map internal hosts and identify potential lateral movement paths. Proactively hunting for this activity in Azure Sentinel is essential because low-severity file executions can indicate early-stage threat presence that may escalate into significant breaches if not correlated with broader network behavior.

YARA Rule

rule FeliksPack3___Scanners_ipscan {
	meta:
		description = "Auto-generated rule on file ipscan.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "6c1bcf0b1297689c8c4c12cc70996a75"
	strings:
		$s2 = "WCAP;}ECTED"
		$s4 = "NotSupported"
		$s6 = "SCAN.VERSION{_"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ipscan.exe detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Network Inventory by Admin

  • Context: A network administrator runs a nightly batch job using a custom script or a tool like PowerShell to execute C:\Tools\NetworkUtils\ipscan.exe against the corporate subnet. This process generates multiple file creation and execution events that mimic suspicious activity but is part of standard maintenance.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Command Line. Exclude alerts where the command line contains specific arguments like --inventory, --full-scan, or includes a known scheduled task name (e.g., AT or Task Scheduler ID: {GUID-Inventory}).
  • Filter Logic: ProcessName = "ipscan.exe" AND CommandLine CONTAINS "--scheduled"

• Scenario: Endpoint Security Agent Health Check

  • Context: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) utilizes ipscan.exe internally as a utility to verify network connectivity and scan local ports during its own health check routine. This often triggers the rule when the agent updates or performs a background scan.
  • Suggested Filter/Exclusion: Exclude events where the Parent Process is the security agent’s main executable (e.g., FalconSensor.exe, MsMpEng.exe, or SentinelOneAgent.exe). This ensures that utility processes spawned by trusted security agents are ignored.
  • Filter Logic: ProcessName = "ipscan.exe" AND ParentProcessName IN ("FalconSensor.exe", "MsMpEng.exe", "SentinelOneAgent.exe")

• **Scenario: Third-Party Patch Management