Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng

Flags Windows launches of Advanced Port Scanner with /portable and /lng parameters.

FreeUnreviewedSigmamediumv1

windows-process-creation-advanced-port-scanner-pua-execution-via-portable-lng-54773c5f

title: "Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng"
id: 19224bbd-4a8a-40b1-a0b8-dcc8d8a40cac
status: test
description: This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.
references:
  - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-18
modified: 2023-02-07
tags:
  - attack.discovery
  - attack.t1046
  - attack.t1135
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \advanced_port_scanner
    - OriginalFileName|contains: advanced_port_scanner
    - Description|contains: Advanced Port Scanner
  selection_cli:
    CommandLine|contains|all:
      - /portable
      - /lng
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative use
  - Tools with similar commandline (very rare)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml
license: DRL-1.1
related:
  - id: 54773c5f-f1cc-4703-9126-2f797d96a69d
    type: derived

What it detects

This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.

Known false positives

Legitimate administrative use
Tools with similar commandline (very rare)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.