Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe

Hunt Hypothesis

This detection identifies adversaries leveraging legacy or disclosed hacking tools, such as the specific “Antiy Ports” executable, to establish a foothold and execute reconnaissance within the environment. Proactively hunting for these artifacts in Azure Sentinel is critical because attackers often reuse known tool signatures to blend with legitimate traffic, allowing them to bypass standard defenses while maintaining persistence on compromised hosts.

YARA Rule

rule Antiy_Ports_1_21 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
	strings:
		$s0 = "AntiyPorts.EXE" fullword wide
		$s7 = "AntiyPorts MFC Application" fullword wide
		$s20 = " @Stego:" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific scenarios that could trigger the “Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe” detection rule in a legitimate enterprise environment, along with suggested filters or exclusions:

• Scenario: Legacy Endpoint Protection Maintenance

  • Context: The IT Operations team performs quarterly maintenance on legacy endpoints still running the older version of the Antiy (Kingsoft) antivirus suite. During these windows, the Antiy Ports 1.21.exe process is executed to update port configurations and scan network interfaces for vulnerabilities.
  • Suggested Filter: Create a whitelist exclusion based on the file path C:\Program Files\Kingsoft Antivirus\Ports\Antiy Ports 1.21.exe and restrict the alert to only trigger if the process hash does not match the known good SHA-256 hash of this specific version.

• Scenario: Scheduled Network Port Audit Job

  • Context: A scheduled System Center Configuration Manager (SCCM) task runs nightly at 02:00 AM on all domain-joined workstations to audit open ports and firewall rules using the Antiy Ports utility as part of compliance reporting.
  • Suggested Filter: Exclude alerts where the parent process is ccmexec.exe or TaskSchedulerService (Windows Task Scheduler) running during off-hours (e.g., 01:00–05:00), ensuring that only unexpected user-initiated launches trigger an alert.

• Scenario: Third-Party Security Assessment Tool Deployment

  • Context: An external security auditor deploys a temporary assessment tool on the QA subnet to map network topology. This tool utilizes the Antiy Ports 1.21 executable as a dependency for its scanning engine, launching it repeatedly across multiple test machines simultaneously.

  ---