Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng
Flags Windows launches of Advanced Port Scanner with /portable and /lng parameters.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-18
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng"
id: 19224bbd-4a8a-40b1-a0b8-dcc8d8a40cac
status: test
description: This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.
references:
- https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-18
modified: 2023-02-07
tags:
- attack.discovery
- attack.t1046
- attack.t1135
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|contains: \advanced_port_scanner
- OriginalFileName|contains: advanced_port_scanner
- Description|contains: Advanced Port Scanner
selection_cli:
CommandLine|contains|all:
- /portable
- /lng
condition: 1 of selection_*
falsepositives:
- Legitimate administrative use
- Tools with similar commandline (very rare)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml
license: DRL-1.1
related:
- id: 54773c5f-f1cc-4703-9126-2f797d96a69d
type: derived