Rules for TCP Portscanner VX.X by WinEggDrop

Hunt Hypothesis

This detection rule identifies adversaries conducting reconnaissance by scanning open TCP ports to map network topology and identify potential entry points. Proactive hunting in Azure Sentinel is essential to uncover stealthy enumeration activities that may precede lateral movement or initial compromise attempts before they escalate into higher-severity incidents.

YARA Rule

rule wineggdrop : portscanner toolkit
{
    meta:
        author = "Christian Rebischke (@sh1bumi)"
        date = "2015-09-05"
        description = "Rules for TCP Portscanner VX.X by WinEggDrop"
        in_the_wild = true
        family = "Hackingtool/Portscanner"

    strings:
        $a = { 54 43 50 20 50 6f 72 74 20 53 63 61 6e 6e 65 72 
               20 56 3? 2e 3? 20 42 79 20 57 69 6e 45 67 67 44 
               72 6f 70 0a } 
        $b = "Result.txt"
        $c = "Usage:   %s TCP/SYN StartIP [EndIP] Ports [Threads] [/T(N)] [/(H)Banner] [/Save]\n"

    condition:
        //check for MZ Signature at offset 0
        uint16(0) == 0x5A4D

        and

        //check for wineggdrop specific strings
        $a and $b and $c 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Rules for TCP Portscanner VX.X by WinEggDrop detection rule, along with suggested filters and exclusions:

• Scenario: Scheduled Network Inventory via Lansweeper or PDQ Inventory

  • Context: Enterprise IT teams often run automated discovery agents (e.g., Lansweeper Agent, PDQ Inventory) that periodically scan all subnets to update asset databases. These tools perform rapid TCP SYN scans across common ports (80, 443, 22, 3389) on thousands of hosts, mimicking the behavior of an external port scanner.
  • Filter/Exclusion: Create a whitelist rule based on the specific source IP address range assigned to the inventory server or agent group. Additionally, filter out events where the Source Port is consistent with the known agent service (e.g., Lansweeper often uses a specific high-numbered ephemeral port) and the scan duration exceeds 60 seconds.

• Scenario: Vulnerability Assessment Scans by Nessus or Qualys

  • Context: Security teams schedule weekly or monthly vulnerability assessments using tools like Tenable Nessus or Qualys Cloud Agent. These scanners aggressively probe open ports to identify missing patches and misconfigurations, generating high volumes of TCP connection attempts that trigger port scanner alerts.
  • Filter/Exclusion: Exclude traffic originating from the dedicated Vulnerability Management Server IP (e.g., 10.20.30.5). Furthermore, apply a time-based exclusion to suppress alerts during known maintenance windows (e.g., “Exclude events occurring between 02:00 and 06:00 UTC on Sundays”).

• Scenario: Active Directory Health Checks via Microsoft SCCM or Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Int