// Overview of SoftPerfect NetScan
SoftPerfect NetScan is a network scanner that can identify connected devices on a network. While it can be a legitimate tool for network administration, its presence may indicate unauthorized use or potential security risks, especially if it's on workstations where it shouldn't be. Understanding how to investigate its presence involves examining logs, using command line tools, and analyzing network traffic.
// Identifying Installed Software
To determine if SoftPerfect NetScan is installed on a Windows workstation, you can check the installed programs list using PowerShell. Here's how to do it:
1. Open PowerShell 2. Run the following command:
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*NetScan*' }Explanation of the Command
- Get-WmiObject -Class Win32_Product: This command retrieves all installed products on the system.
- Where-Object { $_.Name -like 'NetScan' }: Filters the results to display only items that have 'NetScan' in their name.
If SoftPerfect NetScan is installed, you will see output similar to:
Name : SoftPerfect NetScan
Version : 8.3.6
Vendor : SoftPerfect// Checking Running Processes
If you suspect that SoftPerfect NetScan is running but not listed in installed programs, check for active processes:
1. In PowerShell, run:
Get-Process | Where-Object { $_.ProcessName -like '*NetScan*' }Explanation of the Command
- Get-Process: Lists all currently running processes.
- Where-Object { $_.ProcessName -like 'NetScan' }: Filters the process list for any instances of 'NetScan'.
If the app is running, the output will include details about the process, such as ID and memory usage.
// Network Traffic Analysis
To investigate network traffic related to SoftPerfect NetScan, Wireshark is a powerful tool. You can capture and analyze packets to see any suspicious activity. In a controlled environment, perform the following:
1. Start Wireshark and select the appropriate network interface. 2. Set a capture filter:
host <IP of the workstation>Replace <IP of the workstation> with the target workstation's IP address.
3. Initiate a scan from the workstation that you suspect has NetScan installed. 4. Stop the capture after a few minutes and analyze the packets.
Key Indicators to Look For
- Look for outbound connections to unknown IP addresses.
- Check for any unusual ports being scanned, such as 135 (RPC), 445 (SMB), or 3389 (RDP).
- Pay attention to ICMP packets that may indicate ping sweeps.
// Log Analysis
Check Windows Event Logs for any unusual activity or logs related to SoftPerfect NetScan:
1. Open Event Viewer by searching for it in the Start Menu. 2. Navigate to Windows Logs > Application and look for entries that mention NetScan. 3. Similarly, check Security logs for user logins around the time of the scans.
Important Log Entries to Search For
- User logon attempts by accounts not typically used for administrative tasks.
- Application crashes or warnings relating to SoftPerfect NetScan.
// Checklist for Investigation
- [ ] Verify installation of SoftPerfect NetScan.
- [ ] Check for running processes related to NetScan.
- [ ] Capture and analyze network traffic using Wireshark.
- [ ] Review logs in Event Viewer for related activities.
// Defensive Implications
Understanding the presence of SoftPerfect NetScan can help in strengthening your security posture. If found without authorization:
- Remove the application and follow up with a full audit of the workstation.
- Ensure that software installation policies are enforced.
- Educate users on appropriate software usage and potential risks.
This entire investigation is best conducted on a lab setup that you control. Never perform these actions on systems without permission. If you’re looking to refine your skills further, the DaemonCore Academy curriculum is a solid resource without recurring costs.
--- // FIELDOPS REPORT AUTHORIZED BY: Bruce H. //