← Back to SOC feed Coverage →

Detects a chinese Portscanner named MilkT

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-28T11:00:01Z · Confidence: medium

Hunt Hypothesis

This rule detects the presence of the Chinese MilkT port scanner, which adversaries often utilize to map network topology and identify vulnerable entry points for lateral movement. A SOC team should proactively hunt for this activity in Azure Sentinel because early identification of such reconnaissance tools allows for immediate threat containment before attackers can exploit discovered assets or establish persistent footholds within the environment.

YARA Rule

rule CN_Hacktool_MilkT_Scanner {
	meta:
		description = "Detects a chinese Portscanner named MilkT"
		author = "Florian Roth"
		score = 60
		date = "12.10.2014"
	strings:
		$s0 = "Bf **************" ascii fullword
		$s1 = "forming Time: %d/" ascii
		$s2 = "KERNEL32.DLL" ascii fullword
		$s3 = "CRTDLL.DLL" ascii fullword
		$s4 = "WS2_32.DLL" ascii fullword
		$s5 = "GetProcAddress" ascii fullword
		$s6 = "atoi" ascii fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 7 string patterns in its detection logic.

False Positive Guidance

False Positive Scenarios for “Detects a Chinese Portscanner named MilkT” Rule

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar