macOS Process Network Service Scanning via nc or nmap/telnet

Flags macOS executions of nc/netcat, nmap, or telnet consistent with local or remote service enumeration.

FreeReviewedSigma · Low · v4

Product: macos
Category: process_creation
Author: Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-21
Updated: 2026-10-19

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1046Network Service Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions on macOS that appear to enumerate or probe network services using common utilities: netcat-like commands (nc/netcat) or network tools such as nmap and telnet. Attackers use service scanning to discover reachable hosts, open ports, and available services before exploitation or further targeting. Telemetry relies on process creation events, matching executable names by their Image path suffix and applying command-line patterns to further distinguish netcat listen behavior.

Reporting behind it

Related detections9 linkedT1046 — drag to rearrange

Suspicious Advanced IP Scanner Execution for Network Discovery

Suspicious masscan Scanning Docker API Port 2375

Suspicious Network Reconnaissance via Advanced Port Scanner

Suspicious Nmap Scanner Probe URIs in HTTP Requests (via webserver)

Suspicious Internet Scanning for Docker and Kubelet Ports via masscan

Suspicious Fscan Internal Network Scanner Execution (via process_creation)

Possible Network Service Scanning via Nmap or Masscan (via process_creation)

Malicious Anonymous Login - Domain Specified (via security)

Suspicious Network Scanning Tool Execution

macOS Process Network Service Scanning via nc or nmap/telnet

Pivot detection · T1046 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-10-19
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-network-service-enumeration-via-nc-netcat-nmap-or-telnet-84bae5d4

title: macOS Process Network Service Scanning via nc or nmap/telnet
id: aa27ea65-d03f-4eb6-98a1-cdfedb826dcb
status: test
description: "This rule identifies process executions on macOS that appear to enumerate or probe network services using common utilities: netcat-like commands (nc/netcat) or network tools such as nmap and telnet. Attackers use service scanning to discover reachable hosts, open ports, and available services before exploitation or further targeting. Telemetry relies on process creation events, matching executable names by their Image path suffix and applying command-line patterns to further distinguish netcat listen behavior."
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_network_service_scanning.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-21
modified: 2026-10-19
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: macos
detection:
  selection_netcat:
    Image|endswith:
      - /nc
      - /netcat
  selection_other:
    Image|endswith:
      - /nmap
      - /telnet
  filter_main_nc_listen:
    CommandLine|re: \s(?:--listen\b|-[46DdknrtuUvz]{0,10}l[46DdknrtuUvz]{0,10})
  condition: (selection_netcat and not 1 of filter_main_nc_*) or selection_other
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 84bae5d4-b518-4ae0-b331-6d4afd34d00f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL