Linux hack tools - file pscan2

Hunt Hypothesis

This detection rule identifies the presence of the pscan2 file on Linux systems, which often indicates an adversary deploying network scanning or reconnaissance tools to map internal infrastructure and discover vulnerable hosts. A SOC team should proactively hunt for this artifact in Azure Sentinel because early identification of such diagnostic utilities can reveal initial footholds established by attackers before they escalate to more aggressive lateral movement or data exfiltration phases.

YARA Rule

rule LinuxHacktool_eyes_pscan2 {
	meta:
		description = "Linux hack tools - file pscan2"
		author = "Florian Roth"
		reference = "not set"
		date = "2015/01/19"
		hash = "56b476cba702a4423a2d805a412cae8ef4330905"
	strings:
		$s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
		$s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
		$s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
		$s8 = "Invalid IP." fullword ascii
		$s9 = "# scanning: " fullword ascii
		$s10 = "Unable to allocate socket." fullword ascii
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• not set
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Linux hack tools - file pscan2 detection rule, including suggested filters and exclusions:

• Scheduled Security Compliance Scans

  • Scenario: The enterprise runs nightly compliance checks using OpenSCAP or Tripwire, which utilize pscan2 (or similar port scanning utilities) to verify network exposure on critical servers. These jobs are triggered via cron at 02:00 AM daily, executing the tool as a non-interactive system user.
  • Filter/Exclusion: Exclude alerts where the process owner is root or a dedicated service account (e.g., compliance_svc) and the execution time falls within the maintenance window (01:00–04:00). Additionally, filter by command line arguments containing specific flags like --mode=audit.

• DevOps Pipeline Provisioning

  • Scenario: During CI/CD deployments managed by Jenkins or GitLab Runners, the provisioning scripts invoke network discovery tools to validate container port mappings before pushing images to production. The runner executes pscan2 against internal Docker bridges, often running as the jenkins user with elevated privileges.
  • Filter/Exclusion: Create an exclusion for processes spawned by known CI/CD parent processes (e.g., PID lineage containing java, node, or python3 associated with Jenkins/GitLab). Filter based on the source IP belonging to the internal DevOps subnet range (e.g., 10.20.x.x).

• Automated Patch Management & Inventory

  • Scenario: The IT operations team uses Ansible or SaltStack to perform weekly inventory updates and patch assessments. These automation playbooks invoke pscan2 to map open ports on newly patched