Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng

Flags Windows launches of Advanced Port Scanner with /portable and /lng parameters.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-12-18
Updated: 2026-07-30

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1046Network Service Discovery
- T1135Network Share Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.

Reporting behind it

Related detections9 linkedT1046 — drag to rearrange

Windows: Advanced IP Scanner (PUA) Execution via Process Creation

Possible Out-Of-Band Interaction via requestrepo via DNS (via dns_query)

Possible Interactsh Out-Of-Band Interaction via DNS (via dns_query)

Suspicious Advanced IP Scanner Execution for Network Discovery

Suspicious masscan Scanning Docker API Port 2375

Suspicious Network Reconnaissance via Advanced Port Scanner

Suspicious Nmap Scanner Probe URIs in HTTP Requests (via webserver)

Suspicious Internet Scanning for Docker and Kubelet Ports via masscan

Suspicious Fscan Internal Network Scanner Execution (via process_creation)

Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng

Pivot detection · T1046 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-advanced-port-scanner-pua-execution-via-portable-lng-54773c5f

title: "Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng"
id: 19224bbd-4a8a-40b1-a0b8-dcc8d8a40cac
status: test
description: This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.
references:
  - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-18
modified: 2023-02-07
tags:
  - attack.discovery
  - attack.t1046
  - attack.t1135
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \advanced_port_scanner
    - OriginalFileName|contains: advanced_port_scanner
    - Description|contains: Advanced Port Scanner
  selection_cli:
    CommandLine|contains|all:
      - /portable
      - /lng
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative use
  - Tools with similar commandline (very rare)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml
license: DRL-1.1
related:
  - id: 54773c5f-f1cc-4703-9126-2f797d96a69d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL