CN Port Scanner

Hunt Hypothesis

This detection rule identifies adversaries actively performing network reconnaissance by scanning ports to map potential attack surfaces and identify vulnerable services within the Azure environment. Proactively hunting for this behavior allows the SOC team to detect early-stage intrusion attempts before attackers can leverage discovered entry points for lateral movement or exploitation.

YARA Rule

rule CN_Portscan : APT
{
    meta:
        description = "CN Port Scanner"
        author = "Florian Roth"
        release_date = "2013-11-29"
        confidential = false
		score = 70
    strings:
    	$s1 = "MZ"
		$s2 = "TCP 12.12.12.12"
    condition:
        ($s1 at 0) and $s2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the CN Port Scanner detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Vulnerability Assessment Scans

  • Context: Enterprise security teams routinely run automated vulnerability scans using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM. These agents systematically probe all reachable IP ranges and ports on a nightly basis, generating high-volume connection attempts that mimic external port scanning behavior.
  • Filter/Exclusion: Create an exclusion rule based on the source IP range of the vulnerability management server (e.g., 10.50.20.0/24) or filter alerts where the source process name matches known scanner executables (e.g., nessuscli.exe, qualyspcd).

• Scenario: Internal Network Discovery by IT Operations

  • Context: The Network Operations Center (NOC) utilizes tools like SolarWinds NPM, PRTG, or Zabbix to perform active network discovery and device inventory updates. These tools periodically send SYN packets to map the topology of new subnets or verify device reachability, which triggers the port scanner logic.
  • Filter/Exclusion: Exclude traffic originating from specific management VLANs (e.g., 172.16.0.0/16) where monitoring appliances reside, or filter alerts where the destination port is restricted to standard discovery ports like UDP 161 (SNMP) or TCP 443 during off-peak hours.

• Scenario: Automated Software Update and Patch Deployment

  • Context: During scheduled maintenance windows, tools such as Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons perform pre-deployment checks. These agents scan target endpoints to verify open