Skip to content
Threat Feed
Subscribe

Product

Advanced Port Scanner

2 briefs RSS
medium advisory

Detection of Newly Observed Legitimate Network Scanning Tools

Adversaries frequently utilize legitimate network scanning utilities like SoftPerfect Network Scanner and Advanced IP Scanner for reconnaissance following initial compromise to map internal network topology and identify lateral movement targets.

SoftPerfect Network Scanner +2 discovery reconnaissance windows endpoint-detection
1r 2t updated
medium threat

Kerberos Traffic from Unusual Process

Detects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.

Elastic Defend +22 kerberoasting credential-access lateral-movement windows
2r 2t