Auto-generated rule on file MooreR Port Scanner.exe

Hunt Hypothesis

This detection identifies potential reconnaissance activities where adversaries utilize the “MooreR Port Scanner.exe” utility to map network topology and identify open ports for subsequent exploitation. Proactive hunting is essential in Azure Sentinel to distinguish this legitimate scanning behavior from malicious port enumeration that often precedes lateral movement or data exfiltration campaigns within the environment.

YARA Rule

rule MooreR_Port_Scanner {
	meta:
		description = "Auto-generated rule on file MooreR Port Scanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "376304acdd0b0251c8b19fea20bb6f5b"
	strings:
		$s0 = "Description|"
		$s3 = "soft Visual Studio\\VB9yp"
		$s4 = "adj_fptan?4"
		$s7 = "DOWS\\SyMem32\\/o"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the MooreR Port Scanner.exe detection rule, along with targeted exclusion strategies:

• Scheduled Network Inventory Job: The enterprise’s automated network discovery tool, SolarWinds NPM, runs a nightly job at 02:00 AM to map active hosts. This process launches MooreR Port Scanner.exe from the C:\Program Files\NetworkTools\ directory on all domain-joined workstations to verify port availability before updating the CMDB.

  • Suggested Filter: Create an exclusion based on the Process Path (C:\Program Files\NetworkTools\MooreR Port Scanner.exe) and restrict it to run only during the maintenance window (01:00–04:00) or exclude alerts where the parent process is svchost.exe with the service name “SolarWindsInventory”.

• Third-Party Security Compliance Audit: During quarterly compliance audits, the external auditor utilizes a custom script to validate firewall rules. This script invokes MooreR Port Scanner.exe from the shared network drive \\FileServer\ComplianceTools\ on the dedicated audit workstation (hostname: AUDIT-WKSTN-01) to scan internal subnets for open ports.

  • Suggested Filter: Exclude alerts where the Source Hostname matches AUDIT-WKSTN-01 and the process path contains \ComplianceTools\. Additionally, filter by the specific user account used for audits (e.g., DOMAIN\AuditServiceAccount).

• DevOps Pipeline Artifact Validation: The CI/CD pipeline in Jenkins triggers a pre-deployment check where a build agent executes MooreR Port Scanner.exe to verify that new microservices expose the correct ports before containerization. This occurs on the build server `BUILD-AGENT-