Most sweep detections chase tool names. Advanced IP Scanner, NetScan, the renamed ones. Wrong layer. One process hitting 254 IPs across 5 ports is a sweep no matter what the binary is called. dcount…

Your SSH tunnel detection probably has a gap. Hunting ssh.exe -R for reverse port forwarding? A contains "-R" filter misses the variants attackers use to background the tunnel: -NR, -fNR, -fNTR. Use…

If you only hunt for netscan.exe, renamed NetScan binaries will slip past you. Hunt the version info and cmdline instead. SoftPerfect NetScan has been used by 32+ ransomware gangs as mentioned in…

SoftPerfect NetScan is not just an admin tool. 32 ransomware gangs have used it, and The Gentlemen ransomware used it in a recent @TheDFIRReport case. Hunt it by version info first. Then check…