macOS Network Service Enumeration via nc, netcat, nmap, or telnet

Flags macOS executions of nc/netcat, nmap, or telnet consistent with local or remote service enumeration.

FreeUnreviewedSigmalowv1

macos-network-service-enumeration-via-nc-netcat-nmap-or-telnet-84bae5d4

title: macOS Network Service Enumeration via nc, netcat, nmap, or telnet
id: aa27ea65-d03f-4eb6-98a1-cdfedb826dcb
status: test
description: This rule identifies macOS process executions where the binary path ends with /nc or /netcat, or ends with /nmap or /telnet. Such tools are commonly used to enumerate local or remote services during discovery and can help attackers map reachable systems and ports. The detection relies on process creation telemetry, matching executable name suffixes and applying a CommandLine substring filter to reduce some benign cases.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_network_service_scanning.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-21
modified: 2021-11-27
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: macos
detection:
  selection_1:
    Image|endswith:
      - /nc
      - /netcat
  selection_2:
    Image|endswith:
      - /nmap
      - /telnet
  filter:
    CommandLine|contains: l
  condition: (selection_1 and not filter) or selection_2
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 84bae5d4-b518-4ae0-b331-6d4afd34d00f
    type: derived

What it detects

This rule identifies macOS process executions where the binary path ends with /nc or /netcat, or ends with /nmap or /telnet. Such tools are commonly used to enumerate local or remote services during discovery and can help attackers map reachable systems and ports. The detection relies on process creation telemetry, matching executable name suffixes and applying a CommandLine substring filter to reduce some benign cases.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.