This detection rule identifies the presence of “ScanPort,” a Chinese port scanning tool often associated with reconnaissance activities by state-sponsored threat actors mapping network perimeters. Proactive hunting for this behavior in Azure Sentinel is critical to uncover early-stage lateral movement attempts and potential data exfiltration pathways before adversaries establish persistent footholds within the environment.
rule CN_Hacktool_ScanPort_Portscanner {
meta:
description = "Detects a chinese Portscanner named ScanPort"
author = "Florian Roth"
score = 70
date = "12.10.2014"
strings:
$s0 = "LScanPort" fullword wide
$s1 = "LScanPort Microsoft" fullword wide
$s2 = "www.yupsoft.com" fullword wide
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 3 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the “Detects a Chinese Portscanner named ScanPort” rule, along with suggested filters or exclusions:
Scenario: A third-party IT asset management tool (e.g., ** Lansweeper** or SolarWinds NPM) running on a central server initiates periodic network discovery scans using a custom binary named ScanPort.exe to inventory open ports across the enterprise.
10.20.50.5) and the specific process hash (SHA-256: a3f...9b2).Scenario: The internal DevOps team utilizes a scheduled CI/CD pipeline job (via Jenkins or GitLab Runner) that deploys a containerized version of ScanPort to perform pre-deployment security compliance checks against new microservices.
--env=staging) and restrict the rule to trigger only outside of standard maintenance windows (e.g., 02:00–04:00 UTC).Scenario: A legacy network monitoring agent installed on all domain-joined workstations uses a bundled utility named ScanPort to verify local firewall rules and port availability during the daily Group Policy refresh cycle.
SYSTEM, as this indicates an automated system task rather than external scanning activity.Scenario: A specialized compliance audit tool provided by a Chinese vendor (e.g., Huawei Cloud Security Center)