Windows Netspy Network Scanner Execution — Detection Rule
Detects usage of the Netspy scanner on an endpoint. Netspy is a lightweight, fast, and cross-platform tool designed for internal network segment discovery. The tool supports various protocols, including ICMP, ARP, TCP, and UDP, allowing users to scan for active hosts and services within predefined IP ranges.