Detects a chinese Portscanner named SSPort

Hunt Hypothesis

This rule detects the presence of the Chinese port scanning tool “SSPort,” which adversaries may deploy to map network topology and identify exposed services for potential lateral movement or reconnaissance. SOC teams should proactively hunt for this activity in Azure Sentinel because early identification of such specialized scanners allows for rapid containment before attackers can exploit discovered vulnerabilities or establish persistent access points within the environment.

YARA Rule

rule CN_Hacktool_SSPort_Portscanner {
	meta:
		description = "Detects a chinese Portscanner named SSPort"
		author = "Florian Roth"
		score = 70
		date = "12.10.2014"
	strings:
		$s0 = "Golden Fox" fullword wide
		$s1 = "Syn Scan Port" fullword wide
		$s2 = "CZ88.NET" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for “Detects a Chinese Portscanner named SSPort”

• Scenario 1: Third-Party Vulnerability Assessment

  • Context: An external security firm or internal compliance team utilizes the SSPort tool (developed by a Chinese vendor like Sangfor or similar) to conduct scheduled quarterly vulnerability scans against public-facing web servers and DMZ assets. The detection logic triggers whenever the scanner probes standard ports (e.g., 80, 443, 22).
  • Suggested Filter/Exclusion: Create an exclusion rule based on the source IP range of the external assessment team or internal scan servers. Additionally, filter by scheduled time windows (e.g., Time > 01:00 AND Time < 06:00 on weekends) to ignore scans running during off-hours.

• Scenario 2: Internal Network Health Monitoring via Scheduled Jobs

  • Context: The enterprise IT Operations team has deployed a local instance of SSPort as part of their automated network health checks. A Windows Task Scheduler job or cron job runs nightly to verify port availability and firewall rule effectiveness across the internal subnet, triggering the detection rule every night at 02:00 AM.
  • Suggested Filter/Exclusion: Implement a filter that excludes traffic where the process name matches SSPort.exe (or the specific binary hash) running on known internal management hostnames (e.g., MGR-OPS-01, NET-MONITOR).

• Scenario 3: Legacy Application Dependency Check

  • Context: A legacy ERP system or a specific Chinese-manufactured IoT device within the enterprise environment relies on SSPort’s scanning engine for its internal dependency mapping. This tool runs intermittently to ensure connectivity between microservices