Auto-generated rule on file PortScanner.exe

Hunt Hypothesis

This detection identifies potential reconnaissance activity where adversaries utilize a PortScanner.exe tool to map network topology and identify open services for lateral movement opportunities. Proactively hunting for this behavior in Azure Sentinel is essential because early-stage port scanning often precedes more critical attacks like credential dumping or remote exploitation, allowing the SOC team to mitigate risks before they escalate.

YARA Rule

rule PortScanner {
	meta:
		description = "Auto-generated rule on file PortScanner.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "b381b9212282c0c650cb4b0323436c63"
	strings:
		$s0 = "Scan Ports Every"
		$s3 = "Scan All Possible Ports!"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PortScanner.exe detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: IT Admin Network Audit via PowerShell

  • Context: A system administrator runs a scheduled PowerShell script to audit open ports on critical servers. The script invokes C:\Tools\NetworkUtils\PortScanner.exe with arguments like -s 192.168.x.x -p 443. This is a legitimate, manual or scripted administrative task often performed during maintenance windows.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the User Context. Exclude alerts where the Logon User matches specific service accounts (e.g., svc-network-audit) or domain admin groups (e.g., DOMAIN\IT-Admins). Additionally, filter by command line arguments containing -audit or -scheduled.

• Scenario: Endpoint Detection and Response (EDR) Health Check

  • Context: The organization’s EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically launches a native port scanning utility named PortScanner.exe to verify firewall rule integrity and network connectivity between the endpoint and the management server. This occurs automatically every 4 hours.
  • Suggested Filter/Exclusion: Implement an exclusion based on the Parent Process. Exclude alerts where the parent process is the EDR agent executable (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe). This ensures that scans initiated by the security tool itself do not trigger self-alerts.

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: During a scheduled software deployment window, System Center Configuration Manager (SCCM) or Microsoft Intune executes a pre-installation check