PScan - Port Scanner

Hunt Hypothesis

This detection identifies potential reconnaissance activities where adversaries systematically probe network ports to map exposed services and identify vulnerabilities for future exploitation. Proactively hunting for this behavior in Azure Sentinel is critical to detect early-stage threat actors before they leverage discovered entry points to establish persistence or execute lateral movement attacks within the environment.

YARA Rule

rule PScan_Portscan_1 {
	meta:
		description = "PScan - Port Scanner"
		author = "F. Roth"
		score = 50
	strings:
		$a = "00050;0F0M0X0a0v0}0"
		$b = "vwgvwgvP76"
		$c = "Pr0PhOFyP"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PScan - Port Scanner rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Vulnerability Assessment by Tenable Nessus

  • Context: The security team runs a nightly vulnerability scan using Tenable Nessus agents or scanners. These tools systematically probe open ports on all endpoints to identify missing patches, often triggering high-volume port scanning alerts during the maintenance window (e.g., 02:00 – 04:00 UTC).
  • Filter/Exclusion: Create a rule exclusion based on the Source IP of the Nessus management server and agents. Additionally, apply a time-based filter to suppress alerts generated between 02:00 and 06:00 for these specific IPs.

• Scenario: Automated Health Checks by Load Balancers (F5 BIG-IP)

  • Context: Enterprise load balancers like F5 BIG-IP or AWS Elastic Load Balancer perform continuous health checks on backend application servers. These checks involve rapid TCP SYN packets to specific ports (e.g., 80, 443, 8080) every few seconds to verify service availability, which mimics port scanning behavior.
  • Filter/Exclusion: Exclude traffic originating from the Load Balancer VIPs or specific management subnets. If the detection logic relies on connection counts, add a threshold filter: Exclude if connections per minute < 50 for these source IPs, as health checks are high-frequency but low-volume per target.

• Scenario: Network Discovery by Microsoft System Center Configuration Manager (SCCM)

  • Context: During software deployment cycles or inventory updates, Microsoft SCCM agents perform network discovery to map the topology and verify asset reach