Auto-generated rule on file PortRacer.exe

Hunt Hypothesis

This detection identifies the execution of PortRacer.exe, a utility often leveraged by adversaries for network reconnaissance or lateral movement to map open ports and services within the environment. Proactive hunting is essential in Azure Sentinel to distinguish legitimate administrative usage from potential stealthy reconnaissance activities that could precede data exfiltration or unauthorized access attempts.

YARA Rule

rule PortRacer {
	meta:
		description = "Auto-generated rule on file PortRacer.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "2834a872a0a8da5b1be5db65dfdef388"
	strings:
		$s0 = "Auto Scroll BOTH Text Boxes"
		$s4 = "Start/Stop Portscanning"
		$s6 = "Auto Save LogFile by pressing STOP"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PortRacer.exe detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Network Discovery by Admin Staff

  • Context: A network administrator runs a manual or scheduled discovery scan using SolarWinds Network Performance Monitor (NPM) or Microsoft System Center Configuration Manager (SCCM). These tools often utilize PortRacer.exe as a background utility to map open ports and active services across the enterprise subnet.
  • Filter/Exclusion: Create an exclusion based on the parent process name. Filter out alerts where PortRacer.exe is spawned by SolarWindsAgent.exe, ccmexec.exe, or wuauserv.exe. Additionally, exclude execution from specific administrative service accounts (e.g., DOMAIN\NetAdmins).

• Scenario: Endpoint Security Health Check

  • Context: The organization’s endpoint protection suite, such as Trend Micro Apex One or Symantec Endpoint Protection, utilizes PortRacer.exe during its daily “Network Traffic Analysis” task to verify firewall rule compliance and detect unauthorized listening ports. This often occurs during off-hours (e.g., 2:00 AM) via a scheduled Windows Task.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts for this specific file hash between 01:00 and 05:00 local time. Alternatively, exclude the rule if the command line arguments contain keywords like --health-check, --compliance-scan, or --scheduled-task.

• Scenario: Third-Party Asset Management Inventory

  • Context: An IT asset management tool like ServiceNow Discovery Agent or ** Lansweeper** executes a routine inventory job. During the “Port Scan” phase of the discovery agent, it launches