diff --git a/.gitignore b/.gitignore
index dfcfd56..8730c0b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -220,6 +220,7 @@ _pkginfo.txt
 !?*.[Cc]ache/
 
 # Others
+ark_unCat/
 ClientBin/
 ~$*
 *~
diff --git a/linux/configs/_events/3_NetworkConnect/T1046_NetworkServicesScanning.xml b/linux/configs/_events/3_NetworkConnect/T1046_NetworkServicesScanning.xml
new file mode 100644
index 0000000..ef231a4
--- /dev/null
+++ b/linux/configs/_events/3_NetworkConnect/T1046_NetworkServicesScanning.xml
@@ -0,0 +1,17 @@
+<Sysmon schemaversion="4.81">
+  <EventFiltering>
+    <RuleGroup name="" groupRelation="or">
+      <NetworkConnect onmatch="include">
+        <Rule name="TechniqueID=T1046,TechniqueName=Network Services Scanning" groupRelation="or">
+          <Image condition="end with">/netcat</Image>
+          <Image condition="end with">/nc</Image>
+          <Image condition="end with">/telnet</Image>
+          <Image condition="end with">/nmap</Image>
+          <Image condition="end with">/curl</Image>
+          <Image condition="end with">/wget</Image>
+          <CommandLine condition="contains">l</CommandLine>
+        </Rule>
+      </NetworkConnect>
+    </RuleGroup>
+  </EventFiltering>
+</Sysmon>