Detects an unknown GUI scanner tool - CN background

Hunt Hypothesis

This detection identifies the execution of unrecognized GUI scanning tools operating within a Chinese network context, which may indicate an adversary deploying custom reconnaissance utilities to map internal assets and user interfaces. Proactively hunting for this behavior in Azure Sentinel is critical to uncover stealthy initial access or discovery phases that standard signature-based rules might miss due to their novel nature.

YARA Rule

rule CN_GUI_Scanner {
	meta:
		description = "Detects an unknown GUI scanner tool - CN background"
		author = "Florian Roth"
		hash = "3c67bbb1911cdaef5e675c56145e1112"
		score = 65
		date = "04.10.2014"
	strings:
		$s1 = "good.txt" fullword ascii
		$s2 = "IP.txt" fullword ascii
		$s3 = "xiaoyuer" fullword ascii
		$s0w = "ssh(" fullword wide
		$s1w = ").exe" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects an unknown GUI scanner tool - CN background” rule, along with suggested filters or exclusions:

• Scenario: A third-party vulnerability management platform (e.g., Tenable Nessus or Qualys) runs a scheduled agent-based scan on a Domain Controller. The process name in the CN attribute appears as an internal service wrapper rather than the vendor’s standard executable, causing it to be flagged as “unknown.”

  • Suggested Filter: Exclude processes where the ParentImageName matches known vulnerability scanner agents (e.g., nessus.exe, qualyspc.exe) and the CommandLine contains keywords like “scan,” “audit,” or specific port ranges used by these tools.

• Scenario: An automated backup solution (e.g., Veeam Backup & Replication or Rubrik) performs a GUI-based inventory scan of file shares during off-hours. The background service launches a temporary helper process with a generic CN that does not match the primary application name in the rule’s allowlist.

  • Suggested Filter: Create an exclusion for processes running under the context of known backup service accounts (e.g., DOMAIN\VeeamService) where the execution time falls within defined maintenance windows (e.g., 02:00 – 06:00).

• Scenario: The IT security team deploys a custom PowerShell script via System Center Configuration Manager (SCCM) to audit local GUI configurations. This script spawns a background worker process that mimics a scanner tool but lacks the specific digital signature or CN registration in the detection rule’s baseline.

  • Suggested Filter: Exclude events where the UserAccount is a dedicated service account used for SCCM deployments (e.g., DOMAIN\SCCM-Deploy) and the process path