← Back to SOC feed Coverage →

Detects a chinese Portscanner named ScanPort

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-28T11:00:01Z · Confidence: medium

Hunt Hypothesis

This detection rule identifies the presence of “ScanPort,” a Chinese port scanning tool often associated with reconnaissance activities by state-sponsored threat actors mapping network perimeters. Proactive hunting for this behavior in Azure Sentinel is critical to uncover early-stage lateral movement attempts and potential data exfiltration pathways before adversaries establish persistent footholds within the environment.

YARA Rule

rule CN_Hacktool_ScanPort_Portscanner {
	meta:
		description = "Detects a chinese Portscanner named ScanPort"
		author = "Florian Roth"
		score = 70
		date = "12.10.2014"
	strings:
		$s0 = "LScanPort" fullword wide
		$s1 = "LScanPort Microsoft" fullword wide
		$s2 = "www.yupsoft.com" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects a Chinese Portscanner named ScanPort” rule, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar