Rule Info
Name
HackTool - SharpNBTScan Execution
Author
Swachhhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of SharpNBTScan, a tool used for NetBios Scanning. Adversaries use this tool for hostname and IP address enumeration.
Date
2025-03-18 00:00:00
Modified
None
Id
71f4a469-679f-45ff-b869-f7833e39d19e
Tags
attack.discovery attack.t1046 attack.t1018
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR