Suspicious PUA - Advanced Port Scanner Execution (via process_creation)

title: Suspicious PUA - Advanced Port Scanner Execution (via process_creation)
id: 73b5fe89-83ec-5a26-92aa-432519eef1ae
status: stable
description: This rule detects the use of Advanced Port Scanner.
references:
    - https://attack.mitre.org/techniques/T1135/
    - https://attack.mitre.org/techniques/T1046/
    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
author: Huntrule Team
date: 2026-06-24
tags:
    - attack.discovery
    - attack.t1046
    - attack.t1135
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|contains: '\advanced_port_scanner'
        - OriginalFileName|contains: 'advanced_port_scanner'
        - Description|contains: 'Advanced Port Scanner'
    selection_cli:
        CommandLine|contains|all:
            - '/portable'
            - '/lng'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml