A security researcher mentioned creating an Elastic ES|QL version of a threat hunting query, indicating the platform's use for detecting malicious network scanning activity.

{
  "signal_id": "eec05626-4a0a-5916-a594-bfbb47aae735",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-10-03T14:03:29+00:00",
  "company": {
    "name": "Elastic",
    "domain": "elastic.co"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "threat hunting",
      "security",
      "esql"
    ],
    "post_id": "1wwo1t8",
    "summary": "A security researcher mentioned creating an Elastic ES|QL version of a threat hunting query, indicating the platform's use for detecting malicious network scanning activity.",
    "category": "features",
    "comments": [
      {
        "url": "https://www.reddit.com/r/threatintel/comments/1wwo1t8/comment/pdpsshh/",
        "depth": 0,
        "score": 2,
        "author": "ark0x00",
        "excerpt": "Thanks for sharing!",
        "posted_at": "2026-10-04T00:34:40.000Z",
        "author_url": "https://www.reddit.com/user/ark0x00/"
      }
    ],
    "evidence": [
      "[post] The video walks through it on lab telemetry, plus the Elastic ES|QL version, a tool-agnostic network-sweep query, and how to tell an admin from an operator: https://youtu.be/Iun8zko6EZk"
    ],
    "virality": "low",
    "post_date": "2026-10-03T14:03:29.000Z",
    "post_kind": "multi_media",
    "post_text": "SoftPerfect NetScan, Advanced IP Scanner and Advanced Port Scanner keep showing up in the discovery phase before encryption. This is the Defender Advanced Hunting query I use to sweep for all three. It matches on PE vendor metadata and the operator flag pairs, not the file name:\nlet CompanyKeywords = dynamic([\"Famatech\", \"SoftPerfect\"]);\nlet ProductKeywords = dynamic([\"Advanced IP Scanner\", \"Advanced Port Scanner\", \"Network Scanner\"]);\nlet DescKeywords = dynamic([\"Advanced IP Scanner\", \"Advanced Port Scanner\", \"Application for scanning networks\"]);\nDeviceProcessEvents\n| where Timestamp > ago(30d)\n| where ProcessVersionInfoCompanyName has_any (CompanyKeywords)\nor ProcessVersionInfoProductName has_any (ProductKeywords)\nor ProcessVersionInfoFileDescription has_any (DescKeywords)\nor ProcessCommandLine has_all (\"/portable\", \"/lng\")\nor ProcessCommandLine has_all (\"/hide\", \"/auto\")\n| project\nTimestamp, DeviceName, AccountName, FileName,\nProcessCommandLine, ProcessVersionInfoCompanyName,\nProcessVersionInfoProductName, ProcessVersionInfoFileDescription,\nSHA256, InitiatingProcessFileName,\nInitiatingProcessCommandLine, InitiatingProcessParentFileName\nThe video walks through it on lab telemetry, plus the Elastic ES|QL version, a tool-agnostic network-sweep query, and how to tell an admin from an operator: https://youtu.be/Iun8zko6EZk",
    "sentiment": "positive",
    "subreddit": "threatintel",
    "post_title": "One KQL query for the three network scanners that show up across 45+ ransomware groups",
    "prominence": "aside",
    "source_url": "https://www.reddit.com/r/threatintel/comments/1wwo1t8/one_kql_query_for_the_three_network_scanners_that/",
    "entity_role": "vendor",
    "post_author": "securityinbits",
    "upvote_ratio": 1,
    "mention_count": 3,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/threatintel/",
    "total_upvotes": 9,
    "comments_total": 2,
    "total_comments": 2,
    "other_companies": [
      {
        "name": "Microsoft",
        "role": "alternative",
        "domain": "microsoft.com"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/securityinbits/",
    "signal_category": "feedback",
    "comments_included": 1
  }
}

curl https://signals.autobound.ai/v1/signals/eec05626-4a0a-5916-a594-bfbb47aae735 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"elastic.co","limit":20}'