Disclosed hacktool set (old stuff) - file RangeScan.exe

Hunt Hypothesis

This rule detects adversaries leveraging legacy or repurposed hacking tools like RangeScan.exe to conduct network reconnaissance and system enumeration within the environment. Proactive hunting for this behavior in Azure Sentinel is critical to identify potential lateral movement or initial foothold establishment by threat actors utilizing known, yet often overlooked, utility files that may evade standard signature-based defenses.

YARA Rule

rule RangeScan {
	meta:
		description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
	strings:
		$s0 = "RangeScan.EXE" fullword wide
		$s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
		$s9 = "Produced by isn0" fullword ascii
		$s10 = "RangeScan" fullword wide
		$s20 = "%d-%d-%d %d:%d:%d" fullword ascii
	condition:
		3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RangeScan.exe detection rule, including suggested filters or exclusions:

• Scenario: Legacy Network Discovery Scans by SolarWinds NPM

  • Context: The enterprise uses SolarWinds Network Performance Monitor (NPM) which deploys a legacy agent component named RangeScan.exe to perform periodic ARP table sweeps and network topology discovery. This process runs as a scheduled task every 15 minutes on all domain-joined servers, triggering the rule due to its “hacktool” classification in the threat intelligence feed.
  • Suggested Filter: Create an exclusion based on the Process Image Path (C:\Program Files\SolarWinds\NPM\RangeScan.exe) and restrict the alert to only trigger if the process is running under a non-domain service account (e.g., exclude NT SERVICE or specific domain admin accounts like svc_solarwinds).

• Scenario: Automated Asset Inventory by Lansweeper

  • Context: The IT Operations team utilizes Lansweeper for automated hardware and software asset inventory. Their legacy scanning agent, RangeScan.exe, executes nightly to enumerate USB devices and network adapters. Because the file hash has not been updated in the threat intelligence database recently, it is flagged as an “old stuff” hacktool rather than a known good enterprise utility.
  • Suggested Filter: Implement a File Hash Allowlist. Calculate the SHA256 hash of the legitimate RangeScan.exe from a trusted Lansweeper server and add it to the rule’s exclusion list, ensuring that only this specific version triggers no alert regardless of execution time or user context.

• Scenario: Scheduled Maintenance by Dell OpenManage

  • Context: In data centers utilizing Dell PowerEdge servers, the OpenManage Enterprise (OME) suite runs a diagnostic utility named `