LoFP LoFP / legitimate administrator activity

Techniques

Sample rules

PUA - SoftPerfect Netscan Execution

Description

Detects usage of SoftPerfect’s “netscan.exe”. An application for scanning networks. It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.

Detection logic

condition: selection
selection:
- Image|endswith: \netscan.exe
- Product: Network Scanner
- Description: Application for scanning networks

PUA - Nmap/Zenmap Execution

Description

Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

Detection logic

condition: selection
selection:
- Image|endswith:
  - \nmap.exe
  - \zennmap.exe
- OriginalFileName:
  - nmap.exe
  - zennmap.exe

PUA - NimScan Execution

Description

Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.

Detection logic

condition: selection
selection:
- Image|endswith: \NimScan.exe
- Hashes|contains:
  - IMPHASH=41BB1C7571B3A724EB83A1D2B96DBB8C
  - IMPHASH=B1B6ADACB172795480179EFD18A29549
  - IMPHASH=0D1F896DC7642AD8384F9042F30279C2

PUA - RemCom Default Named Pipe

Description

Detects default RemCom pipe creation

Detection logic

condition: selection
selection:
  PipeName|contains: \RemCom

PUA - CSExec Default Named Pipe

Description

Detects default CSExec pipe creation

Detection logic

condition: selection
selection:
  PipeName|contains: \csexecsvc

ETW Logging/Processing Option Disabled On IIS Server

Description

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_etw_added:
  NewValue|contains: ETW
selection:
  Configuration|endswith: '@logTargetW3C'
  EventID: 29
  OldValue|contains: ETW

Previously Installed IIS Module Was Removed

Description

Detects the removal of a previously installed IIS module.

Detection logic

condition: selection
selection:
  Configuration|contains: /system.webServer/modules/remove
  EventID: 29

New Module Module Added To IIS Server

Description

Detects the addition of a new module to an IIS server.

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_builtin:
  NewValue:
  - AnonymousAuthenticationModule
  - CustomErrorModule
  - DefaultDocumentModule
  - DirectoryListingModule
  - FileCacheModule
  - HttpCacheModule
  - HttpLoggingModule
  - ProtocolSupportModule
  - RequestFilteringModule
  - StaticCompressionModule
  - StaticFileModule
  - TokenCacheModule
  - UriCacheModule
filter_main_remove:
  NewValue: ''
selection:
  Configuration|contains: /system.webServer/modules/add
  EventID: 29

OpenSSH Server Listening On Socket

Description

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Detection logic

condition: selection
selection:
  EventID: 4
  payload|startswith: 'Server listening on '
  process: sshd

New File Exclusion Added To Time Machine Via Tmutil - MacOS

Description

Detects the addition of a new file or path exclusion to MacOS Time Machine via the “tmutil” utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

Detection logic

condition: all of selection_*
selection_cmd:
  CommandLine|contains: addexclusion
selection_img:
- Image|endswith: /tmutil
- CommandLine|contains: tmutil

Time Machine Backup Disabled Via Tmutil - MacOS

Description

Detects disabling of Time Machine (Apple’s automated backup utility software) via the native macOS backup utility “tmutil”. An attacker can use this to prevent backups from occurring.

Detection logic

condition: all of selection_*
selection_cmd:
  CommandLine|contains: disable
selection_img:
- Image|endswith: /tmutil
- CommandLine|contains: tmutil