Detects a chinese BAT hacktool for local port evaluation

Hunt Hypothesis

This detection rule identifies the execution of Chinese BAT scripting tools performing local port enumeration, a behavior often associated with initial reconnaissance or lateral movement by threat actors leveraging custom automation scripts. Proactive hunting for this activity in Azure Sentinel is critical to uncover stealthy post-compromise actions that may evade standard signature-based defenses and reveal early indicators of supply chain or insider threats targeting network topology discovery.

YARA Rule

rule CN_Hacktool_BAT_PortsOpen {
	meta:
		description = "Detects a chinese BAT hacktool for local port evaluation"
		author = "Florian Roth"
		score = 60
		date = "12.10.2014"
	strings:
		$s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
		$s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
		$s2 = "@echo off" ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects a Chinese BAT hacktool for local port evaluation,” including suggested filters and exclusions:

• Scenario: Automated Network Inventory Script Execution

  • Context: IT Operations teams often use custom PowerShell or Bash scripts to scan internal subnets. A common practice involves invoking netstat or nmap via a .bat wrapper (e.g., PortScan_Daily.bat) which enumerates local listening ports on the host itself before scanning remote targets.
  • Filter/Exclusion: Create an exclusion for the specific hash of the known inventory script and its parent process path (e.g., C:\Scripts\Ops\PortScan_Daily.bat). Additionally, filter out events where the command line argument contains keywords like /inventory or --local-scan.

• Scenario: Scheduled Service Health Checks via Task Scheduler

  • Context: Enterprise monitoring tools (such as SolarWinds or custom Nagios agents) frequently schedule a BAT file to run every 15 minutes. This script executes a local port evaluation to verify that critical services (e.g., SQL Server on 1433, IIS on 80/443) are bound correctly before reporting status to the central dashboard.
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe or TaskSchedulerService and the executable name matches known monitoring BAT files (e.g., HealthCheck_PortStatus.bat). Filter based on a recurring time window (e.g., 09:00–17:00) if the job runs only during business hours.

• Scenario: Deployment of Chinese Enterprise Resource Planning (ERP) Modules

  • Context: Many organizations utilize ERP systems with Chinese origins (such as Kingdee, Yonyou, or specific modules from