Detecting NimScan Execution with Uncoder AI’s Decision Tree for Cortex XQL

Potentially Unwanted Applications (PUAs) like NimScan are increasingly used by adversaries during the reconnaissance phase to map open ports or identify network assets. Detecting their execution early is key—but doing so with hash-based or path-based rules in Cortex XQL can result in logic that’s functional, but hard to interpret quickly.

Uncoder AI’s AI-generated Decision Tree solves this problem by transforming raw query syntax into a human-readable, branch-based breakdown—making it faster and easier to understand what’s being detected and why.

Explore Uncoder AI

Use Case: Identifying NimScan via Path or IMPHASH

The Cortex XQL rule identifies NimScan activity using two main methods:

1. Process Image Path Check:
   The rule flags any process where the action_process_image_path matches a regex ending in \NimScan.exe , regardless of the preceding path.
   
   
2. IMPHASH Matching:
   The detection also checks if the process carries a known malicious IMPHASH value from a predefined list—each associated with known NimScan builds.
   
   

These conditions are connected using an OR logic, meaning any one match will trigger the detection.

Input we used (click to show the text)

(SrcProcImagePath ContainsCIS "\explorer.exe" AND TgtProcImagePath ContainsCIS "\notepad.exe" AND (TgtProcCmdLine ContainsCIS "password.txt" OR TgtProcCmdLine ContainsCIS "password.csv" OR TgtProcCmdLine ContainsCIS "password.doc" OR TgtProcCmdLine ContainsCIS "password.xls"))

How AI-generated Decision Tree Makes It Clear

Instead of presenting a flat block of logic, Uncoder AI turns this into a step-by-step tree structure:

• Root Node: The query begins with a filter condition.
  
  
• Left Child: Checks if the image path matches NimScan’s executable.
  
  
• Right Child: Independently evaluates if any of the listed IMPHASHes are present in the Hashes field.
  
  
• Leaf Nodes: Each hash is evaluated individually, making logic transparent.
  
  

This logical clarity is especially useful in a high-pressure SOC environment, where analysts must quickly determine what a detection actually covers.

AI Output (click to show the text)

A very specific and technical question!

The decision tree for the condition part of this s1-event is as follows:

1. **Root Node**: Evaluate `SrcProcImagePath ContainsCIS "\explorer.exe"`

* If true, proceed to next node

* If false, event does not match

2. **Node 2**: Evaluate `TgtProcImagePath ContainsCIS "\notepad.exe"`

* If true, proceed to next node

* If false, event does not match

3. **Node 3**: Evaluate `(TgtProcCmdLine ContainsCIS "password.txt" OR TgtProcCmdLine ContainsCIS "password.csv" OR TgtProcCmdLine ContainsCIS "password.doc" OR TgtProcCmdLine ContainsCIS "password.xls")`

* This node has four child nodes, one for each `OR` condition:

+ **Node 3.1**: Evaluate `TgtProcCmdLine ContainsCIS "password.txt"`

- If true, event matches

- If false, proceed to next child node

+ **Node 3.2**: Evaluate `TgtProcCmdLine ContainsCIS "password.csv"`

- If true, event matches

- If false, proceed to next child node

+ **Node 3.3**: Evaluate `TgtProcCmdLine ContainsCIS "password.doc"`

- If true, event matches

- If false, proceed to next child node

+ **Node 3.4**: Evaluate `TgtProcCmdLine ContainsCIS "password.xls"`

- If true, event matches

- If false, event does not match

In summary, the decision tree evaluates three main conditions:

2. The target process image path contains `\notepad.exe`

3. The target process command line contains any of the specified password-related file names (`password.txt`, `password.csv`, `password.doc`, or `password.xls`)

If all three conditions are true, the event matches; otherwise, it does not match.

Practical Benefits

• Hash Context Awareness: Analysts can validate whether new samples match known indicators.
  
  
• Faster Rule Auditing: Teams can quickly assess whether existing detection logic needs to be expanded.
  
  
• Improved Communication: Tree view helps share logic with non-engineering stakeholders or IR responders.
  
  

In this case, Uncoder AI turned a technically dense detection into an operational asset—streamlining validation, tuning, and incident response.

Summary: From Hashes to High-Fidelity Detection

Uncoder AI’s Decision Tree is more than a visual—it’s an interpreter that helps security teams act faster and smarter. Whether you’re validating Cortex XQL rules or operationalizing new threat intelligence, this feature turns complexity into clarity.

Explore Uncoder AI