Storm-1175 - NetScan & Advanced IP Scanner (T1046)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•6

Identifies the execution of portable network scanning utilities (netscan.exe, advanced_ip_scanner.exe) that also initiate network connections to common administrative ports (135, 445, 3389). This activity is often observed post-breach to map the internal network.