Detects a chinese Portscanner named s.exe

Hunt Hypothesis

This hypothesis targets adversaries leveraging a Chinese port scanning tool named s.exe to map network infrastructure and identify potential entry points for lateral movement. Proactive hunting in Azure Sentinel is critical because this specific executable often indicates early-stage reconnaissance by threat actors from China, allowing the SOC team to isolate compromised assets before deeper intrusion occurs.

YARA Rule

rule CN_Hacktool_S_EXE_Portscanner {
	meta:
		description = "Detects a chinese Portscanner named s.exe"
		author = "Florian Roth"
		score = 70
		date = "12.10.2014"
	strings:
		$s0 = "\\Result.txt" fullword ascii
		$s1 = "By:ZT QQ:376789051" fullword ascii
		$s2 = "(http://www.eyuyan.com)" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects a Chinese Portscanner named s.exe” rule, along with suggested filters and exclusions:

• Scenario: Legitimate Backup Agent Execution

  • Context: Many enterprise backup solutions (e.g., Veeam, Acronis) or database maintenance tools utilize lightweight executables named s.exe to perform nightly port scanning for connectivity checks before initiating data transfer. These processes often run under the context of a dedicated service account rather than an interactive user session.
  • Filter/Exclusion: Exclude alerts where the process path matches known backup installation directories (e.g., C:\Program Files\Veeam\Backup and Replication\s.exe) AND the parent process is a recognized service host (svchost.exe or wuauserv.exe).

• Scenario: Scheduled Network Health Check Job

  • Context: IT Operations teams often deploy custom PowerShell scripts or third-party monitoring agents (like SolarWinds or PRTG) that wrap a scanning utility in an executable named s.exe. These jobs are typically triggered via Windows Task Scheduler to run during off-hours, scanning internal subnets for open ports.
  • Filter/Exclusion: Filter out events where the parent process is TaskScheduler (mscorsvw.exe or cmd.exe launched by scheduler) AND the execution time falls within a defined maintenance window (e.g., 02:00 – 04:00 local time).

• Scenario: Endpoint Detection and Response (EDR) Component

  • Context: Certain EDR or antivirus suites (such as Symantec Endpoint Protection or specific modules of Trend Micro) include a network discovery component named s.exe that periodically scans local ports to identify new devices on the LAN for policy enforcement. This is standard behavior in a secure enterprise environment.