Reviewed the S1 alert Advance IP scanner is a known tool used by our technicians. Checked the timeline on this machine from the date 5/11 and confirmed one of our technicians was on the machine around this time. Marking as a false positive. No further action is required. Closing ticket.
Reviewed the S1 alert Advance IP scanner is a known tool used by our technicians. Checked the timeline on this machine from the date 5/11 and confirmed one of our technicians was on the machine around this time. Marking as a false positive. No further action is required. Closing ticket.
A security agent detected suspicious software on a desktop used by user 'LYNDONPC2\Jennifer', assessed as a moderate-severity discovery due to its potentially unwanted scanning capability and impact on visibility. The threat was automatically mitigated and quarantined by endpoint controls, so active risk is reduced. Business impact is limited but could include unauthorized network scanning and potential exposure of internal assets if similar activity occurred elsewhere.
SOC Response Actions Actions the SOC performed (or attempted). Follow this link for further information on Use Case #5 and Use Case #6. ActionStatus
--- --- LyndonPC2, no full disk scan command was sent. Not Configured LyndonPC2, endpoint was not isolated from the network. Not Configured
Recommended Remediation
[Containment] Isolate host 'LyndonPC2' from the network and block its external IP '23.24.19.166' at the firewall to prevent further lateral movement or data exfiltration.
[Eradication] Remove the file '\Device\HarddiskVolume3\Users\Jennifer\Documents\Atlantic Connect\Temp\Advanced_IP_Scanner_2.5.4594.1.exe' and any remaining copies from the endpoint and backups.
[Eradication] Uninstall unauthorized remote access software 'ScreenConnect.WindowsClient.exe' and validate no other remote-access tools are present on the host.
[Hardening] Reset credentials for user 'LYNDONPC2\Jennifer' and enforce MFA on the account to reduce risk of credential reuse.
[Hardening] Apply latest endpoint and OS security updates and ensure group policy or EDR policy prevents execution from user Temp directories and restricts use of hacktools like Advanced IP Scanner.
26d5748f...593c193b Malicious File hash detected by 2 security engines. Classified under the meaningful name Advanced_IP_Scanner_2.5.4594.1.exe. Hybrid-Analysis
26d5748f...593c193b Malicious File hash detected by 3 security engines. Classified under the meaningful name Advanced_IP_Scanner_2.5.4594.1.exe. Indicators of Compromise
The threat indicator reveals the detection of a hacking tool known as 'Advanced IP Scanner.' This tool is often used by attackers to scan networks for connected devices, potentially identifying vulnerabilities that could be exploited. Its presence on a system suggests that there may be unauthorized attempts to gather information about the network, which poses a significant security risk. Immediate action is needed to investigate and mitigate any potential threats associated with this tool to protect the system and its data.
