title: Watcher-NetAI — astats scanner (skn module) execution
id: 7a9e2c80-3d8f-4f1d-9c7a-1a4e5d8b0c02
status: experimental
description: |
  Detects the Watcher-NetAI scanner module (operator-internal name `skn`,
  filename `astats`) when invoked with its watchdog/scan/launcher argv shape.
  Three independent selections cover the parent watchdog process, the spawned
  scan worker, and the launcher script's four-token role-label argv list.
author: OHIIHO Research
date: 2026-05-14
references:
  - Watcher-NetAI / skn public report, OHIIHO Research, 2026-05-14
tags:
  - attack.execution
  - attack.t1059.004
  - attack.discovery
  - attack.t1018
logsource:
  category: process_creation
  product: linux
detection:
  sel_watchdog:
    Image|endswith: '/astats'
    CommandLine|contains: '-watchdog'
  sel_scan:
    Image|endswith: '/astats'
    CommandLine|contains: '-scan'
  sel_launcher:
    CommandLine|contains|all:
      - '"astats"'
      - '"netai"'
      - '"kstats"'
      - '"ssh 2 ranges"'
  condition: 1 of sel_*
fields:
  - User
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
falsepositives:
  - Unlikely on production hosts. The four-token launcher arg list is operator-defined.
level: high
