Auto-generated rule on file NetBIOS Name Scanner.exe

Hunt Hypothesis

This detection identifies the execution of “Scanner.exe,” a process often associated with NetBIOS name enumeration that adversaries leverage to map network topology and discover active hosts during initial reconnaissance phases. Proactive hunting for this behavior in Azure Sentinel is essential to distinguish legitimate administrative scanning from stealthy threat actors attempting to establish a foothold before launching lateral movement attacks.

YARA Rule

rule NetBIOS_Name_Scanner {
	meta:
		description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "888ba1d391e14c0a9c829f5a1964ca2c"
	strings:
		$s0 = "IconEx"
		$s2 = "soft Visual Stu"
		$s4 = "NBTScanner!y&"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Auto-generated rule on file NetBIOS Name Scanner.exe, including suggested filters and exclusions:

• Scenario: Scheduled Network Inventory Scans by Admin Tools

  • Context: Enterprise IT departments often deploy tools like SolarWinds NPM, Lantronix Device Insight, or custom PowerShell scripts to perform nightly network discovery. These tools frequently spawn a process named NetBIOS Name Scanner.exe (or similar) from the C:\Program Files\NetworkTools\Inventory\ directory to enumerate active NetBIOS nodes on the subnet.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Image Path. Exclude any execution where the path starts with C:\Program Files\NetworkTools\Inventory\NetBIOS Name Scanner.exe. Additionally, add a filter for specific User Context (e.g., DOMAIN\AdminService or NT SERVICE\NetworkInventory) to ensure only service accounts trigger this.

• Scenario: Endpoint Security Agent Health Checks

  • Context: Modern EDR solutions such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often utilize internal diagnostic utilities to verify network connectivity and NetBIOS name resolution capabilities during agent initialization or periodic health checks. These agents may launch a standalone utility named NetBIOS Name Scanner.exe within their installation directory (e.g., C:\Program Files\CrowdStrike\).
  • Suggested Filter/Exclusion: Implement an exclusion based on the Parent Process. If the parent process is a known security agent executable (e.g., csagent.exe, SentinelOneAgent.exe, or MsMpEng.exe), suppress the alert. This ensures that internal housekeeping scans by the EDR itself do not generate noise.

• **Scenario: