StrikeShark FScan Network Reconnaissance Tool Execution
Detects the execution of the FScan tool, used by the StrikeShark threat actor for internal network reconnaissance, port scanning, and host discovery. The rule triggers on common binary names associated with FScan and specific command-line arguments indicative of scanning activity, such as CIDR range targeting and port flags, while excluding other known network utilities.
Sigma
