Detects a chinese Portscanner named MilkT - shipped BAT

Hunt Hypothesis

This rule detects the presence of the Chinese port scanner “MilkT,” which adversaries often deploy to map network topology and identify vulnerable services for subsequent exploitation. Proactively hunting for this activity in Azure Sentinel is critical because early identification of MilkT allows the SOC team to isolate reconnaissance efforts before they escalate into full-scale data exfiltration or lateral movement attacks.

YARA Rule

rule CN_Hacktool_MilkT_BAT {
	meta:
		description = "Detects a chinese Portscanner named MilkT - shipped BAT"
		author = "Florian Roth"
		score = 70
		date = "12.10.2014"
	strings:
		$s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
		$s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the MilkT port scanner detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Vulnerability Assessment by Security Team

  • Context: The internal security team runs a weekly vulnerability scan using Qualys Cloud Agent or Tenable Nessus. These tools often utilize the MilkT signature in their scanning engine to probe open ports on the enterprise network.
  • Suggested Filter/Exclusion: Create an exclusion based on the Source IP range of the dedicated scanning servers (e.g., 10.50.20.0/24) and restrict the rule trigger to only occur outside of business hours (e.g., 02:00 – 06:00 local time) if the scan is scheduled for off-hours.

• Scenario: Third-Party Cloud Security Integration

  • Context: The organization utilizes a SaaS security posture management tool like Palo Alto Networks Prisma Cloud or CrowdStrike Falcon. These platforms perform continuous external attack surface monitoring, which often deploys MilkT-based probes to scan public-facing assets.
  • Suggested Filter/Exclusion: Implement an exclusion for traffic originating from known Cloud Provider IP ranges (e.g., AWS 54.x.x.x, Azure 20.x.x.x) associated with the specific security vendor’s scanning service, or exclude traffic on ports commonly used by these tools (e.g., 80, 443) if the scan is passive.

• Scenario: Automated Compliance Audit Job

  • Context: A scheduled job running via Ansible Tower or Jenkins CI/CD pipeline executes a compliance check against new deployments. This job triggers a MilkT scanner to verify that newly provisioned VMs adhere to port