Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe

Hunt Hypothesis

This hunt hypothesis detects adversaries executing initial network reconnaissance by deploying a known port scanning utility to map exposed services and identify potential entry points within the Azure environment. Proactive hunting for this behavior is essential because early detection of such scanning activities allows the SOC team to validate legitimate traffic against anomalous patterns, thereby preventing attackers from leveraging these insights to plan subsequent lateral movement or exploitation phases before they escalate.

YARA Rule

rule StealthWasp_s_Basic_PortScanner_v1_2 {
	meta:
		description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "7c0f2cab134534cd35964fe4c6a1ff00"
	strings:
		$s1 = "Basic PortScanner"
		$s6 = "Now scanning port:"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the StealthWasp’s Basic PortScanner v1.2.exe detection rule, including tailored filters and exclusions:

• Scheduled Security Audit Job: The enterprise runs a nightly vulnerability assessment using Tenable Nessus or Qualys, which deploys a local agent that executes Basic PortScanner v1.2.exe to map open ports on endpoints before the main scan begins.

  • Filter/Exclusion: Create an exclusion based on the Process Parent. If the parent process is nessusagent.exe or qualyspcapd.exe, suppress the alert for this specific executable path (e.g., C:\Program Files\StealthWasp\Tools\Basic PortScanner v1.2.exe).

• IT Helpdesk Remote Diagnostics: A Tier 2 Support Engineer uses a standardized “Remote Toolkit” deployed via Microsoft Endpoint Configuration Manager (SCCM) to troubleshoot network connectivity issues on user workstations, launching the port scanner from a known admin account context.

  • Filter/Exclusion: Implement a rule that ignores alerts where the User Account belongs to the IT-Support group or specific service accounts (e.g., svc-helpdesk) and the execution occurs between 08:00 and 18:00 on business days.

• DevOps CI/CD Pipeline Execution: During the deployment phase of a new application, the Jenkins build server triggers a containerized job that mounts a shared volume containing Basic PortScanner v1.2.exe to verify firewall rules against newly provisioned VMs in the Azure/AWS environment.

  • Filter/Exclusion: Exclude alerts where the Source Hostname matches the naming convention of CI servers (e.g., Jenkins-Build-01, `CI-Agnt