Investigating SoftPerfect NetScan presence on workstations

// Understanding SoftPerfect NetScan

SoftPerfect NetScan is a network scanner tool that provides visibility into the network's devices, open ports, and services. It’s often used for legitimate network management tasks, but if discovered on a workstation without clear authorization or purpose, it could indicate unauthorized reconnaissance activities.

// Why Investigate?

If you find SoftPerfect NetScan on a workstation, it’s essential to investigate for several reasons:

• Unauthorized Use: The tool can be used for malicious purposes, such as discovering vulnerabilities or mapping the network.
• Compliance Issues: Depending on your organization’s policies, unauthorized tools can violate security protocols.
• Network Hygiene: Regularly checking for unexpected software enhances overall security posture.

// Steps to Investigate NetScan Presence

1. Identify Installed Software Use the following command to list installed software on a Windows machine:

   Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*NetScan*' }

This checks for any instance of SoftPerfect NetScan. If it exists, take note of the installation path.

2. Check Running Processes Investigate if the application is currently running:

   Get-Process | Where-Object { $_.ProcessName -like '*NetScan*' }

This provides information about the running instance, including its PID (Process ID), which is useful for further investigation.

3. Review Network Activity Use Wireshark to monitor network traffic generated by SoftPerfect NetScan. Start capturing traffic:

   wireshark

Set a capture filter for traffic specifically related to NetScan:

   host <IP_ADDRESS_OF_TARGET>

Replace <IP_ADDRESS_OF_TARGET> with the respective device you want to monitor. Look specifically for traffic that reveals scanning activities, such as TCP SYN packets directed at multiple ports on target devices.

4. Examine Logs Investigate Windows Event Logs to identify any anomalous access or errors related to the use of NetScan. Execute:

   Get-EventLog -LogName Application | Where-Object { $_.Message -like '*NetScan*' }

This command filters the application logs for entries related to SoftPerfect NetScan, which can provide insights into its usage.

5. Assess User Accounts Determine which user accounts have installed or run the software:

   Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.LocalPath -like '*<USERNAME>*' }

Replace <USERNAME> with the account name you suspect might have utilized NetScan.

// Defensive Implications

If SoftPerfect NetScan is found unauthorized, you need to act promptly:

• Remove the Application: If confirmed unauthorized, remove it:

  Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -eq 'SoftPerfect NetScan' } | ForEach-Object { $_.Uninstall() }

• Investigate Further: Look for any signs of unauthorized access or data exfiltration.
• Update Security Policies: Ensure that usage policies around network scanning tools are clear and enforced.

// Mistakes to Avoid

• Ignoring the Tool’s Presence: Just because a tool is commonly used doesn't mean it’s authorized in your environment!
• Failing to Monitor Network Activity: Not observing network traffic can lead to missing malicious activities.
• Neglecting Documentation: Always document your findings and actions taken for accountability and auditing purposes.

// Checklist for Investigation

• [ ] Confirm installation of SoftPerfect NetScan.
• [ ] Check if it is running.
• [ ] Monitor network traffic for unusual activities.
• [ ] Examine event logs for anomalies.
• [ ] Verify user account usage.
• [ ] Remove if found unauthorized.
• [ ] Document findings.

The proper handling of tools like SoftPerfect NetScan is integral to maintaining network security. Regular audits and monitoring are necessary to prevent unauthorized use.

--- // FIELDOPS REPORT AUTHORIZED BY: Rachel H. //