NewsPublished 28 Sep 2026

You found SoftPerfect NetScan on a workstation. Would you investigate right away?

Source Reddit Cybersecurity

Discussion

SoftPerfect NetScan is a network scanning tool that may be found on workstations. Its presence alone does not definitively indicate malicious activity such as ransomware, but it warrants further investigation with contextual telemetry to determine intent. The tool can run in GUI mode or headless mode, with the latter potentially indicating scripted or automated network discovery. Analysts should use endpoint telemetry and query languages like KQL or ES|QL to differentiate between benign IT scanning and potentially malicious reconnaissance.

r/cybersecurity (opens in a new tab)u/securityinbits0 points0 comments

I was working through a lab around ransomware discovery and one question kept coming up:

When you see SoftPerfect NetScan (or Advanced IP Scanner) on a workstation, is that enough on its own, or do you need more context before treating it as real ransomware discovery?

One thing that changed my triage: the same tool can run as the GUI or headless (advanced_ip_scanner_console.exe, netscan.exe /hide /auto). Which binary ran is a hint about whether someone was on a desktop or a script ran it.

I made a video on how I triaged that from the defender side using MDE telemetry and KQL, plus the same sweep in Elastic ES|QL.

Video: https://www.youtube.com/watch?v=Iun8zko6EZk

The goal was simple: move from "IT scanning the network" to "someone is running discovery on this host."

Links cited in the discussion

https://www.youtube.com/watch?v=Iun8zko6EZk

Impact

The presence of SoftPerfect NetScan itself does not constitute a direct security vulnerability or exploit. However, its use by an unauthorized party could indicate network reconnaissance activity, which is a common precursor to lateral movement or ransomware deployment. Without additional context, it is not possible to determine if the tool's presence is benign or malicious.

Defensive guidance

Investigators should gather additional context from endpoint telemetry to determine the nature of the NetScan usage. Pay attention to whether the tool was run interactively or via automated/scripted means. Use detection tools and query languages to correlate this activity with other suspicious behaviors before escalating.

Summary

SoftPerfect NetScan is a legitimate network scanning utility that can operate in both GUI and headless modes. The detection of this tool on a workstation raises questions about whether it is part of normal IT operations or an indicator of adversarial network discovery activity. The headless mode (e.g., advanced_ip_scanner_console.exe, netscan.exe /hide /auto) suggests scripted execution, which may be more suspicious. The referenced analysis uses Microsoft Defender for Endpoint telemetry and Elastic Security query languages to triage and contextualize such detections, aiming to distinguish routine IT scans from potential ransomware or other threat actor reconnaissance.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 28 Sep 2026, 13:17 UTC

Technical details

References

Community reviews