Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe

Hunt Hypothesis

This rule detects the execution of LScanPortss.exe, a known reconnaissance tool associated with Chinese threat actors that scans network ports to map internal infrastructure and identify potential entry points. Proactive hunting for this artifact in Azure Sentinel is critical because its presence often signals early-stage adversary activity, allowing the SOC team to investigate lateral movement capabilities before more intrusive actions occur.

YARA Rule

rule CN_Toolset_LScanPortss_2 {
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
		author = "Florian Roth"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
		date = "2015/03/30"
		score = 70
		hash = "4631ec57756466072d83d49fbc14105e230631a0"
	strings:
		$s1 = "LScanPort.EXE" fullword wide
		$s3 = "www.honker8.com" fullword wide
		$s4 = "DefaultPort.lst" fullword ascii
		$s5 = "Scan over.Used %dms!" fullword ascii
		$s6 = "www.hf110.com" fullword wide
		$s15 = "LScanPort Microsoft " fullword wide
		$s18 = "L-ScanPort2.0 CooFly" fullword wide
	condition:
		4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://qiannao.com/ls/905300366/33834c0c/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule targeting LScanPortss.exe, along with suggested filters and exclusions:

• Scenario: Legitimate Network Port Scanning by IT Operations

  • Context: The internal Network Operations Center (NOC) utilizes a scheduled task on a dedicated management server to run nightly port audits. They have deployed the LScanPortss.exe utility as part of their standard toolkit to map open ports and verify firewall rules across the enterprise subnet.
  • Filter/Exclusion: Create an exclusion rule that allows execution of LScanPortss.exe when launched by the specific service account svc-netops-audit or from a known trusted path (e.g., C:\Program Files\NetTools\LScanPortss.exe). Additionally, exclude alerts if the process parent is Task Scheduler (svchost.exe) and the job name contains “Nightly Port Audit”.

• Scenario: Deployment of Third-Party Endpoint Security Agent

  • Context: The enterprise has integrated a third-party endpoint detection and response (EDR) solution that bundles LScanPortss.exe as a helper component for its real-time network traffic analysis module. This file is installed on all workstations during the initial agent deployment via SCCM or Intune.
  • Filter/Exclusion: Exclude alerts where the process path matches the EDR vendor’s installation directory (e.g., C:\Program Files\VendorSecurityAgent\Components\LScanPortss.exe). Furthermore, filter out instances where the file hash matches the known good SHA-256 hash provided by the vendor for version 4.2.x.

• Scenario: Automated Compliance Reporting Script

  • Context: The Security Compliance team runs a weekly PowerShell script to generate regulatory reports on network exposure. This script invokes LScanPortss.exe