Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1046Network Service Discovery
- T1135Network Share Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.

Reporting behind it

Related detections9 linkedT1046 — drag to rearrange

Windows: Advanced IP Scanner (PUA) Execution via Process Creation

Suspicious Fscan Internal Network Scanner Execution (via process_creation)

Possible Network Service Scanning via Nmap or Masscan (via process_creation)

Malicious Anonymous Login - Domain Specified (via security)

Malicious Network Share Discovery And/or Connection via Commandline (via process_creation)

Suspicious Network Scanning Tool Execution

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

Malicious Anonymous Access Performed to Multiple Targets (via security)

Suspicious Enabling of Network Discovery Firewall Rules via PowerShell

Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng

Pivot detection · T1046 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-advanced-port-scanner-pua-execution-via-portable-lng-54773c5f

title: "Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng"
id: 19224bbd-4a8a-40b1-a0b8-dcc8d8a40cac
status: test
description: This rule identifies process creation events where an Advanced Port Scanner executable is launched, either by image/filename strings or by embedded product description text. It further requires command-line parameters indicative of the tool’s execution (/portable and /lng), which attackers may use to probe open network services. The detection relies on Windows process creation telemetry, matching Image, OriginalFileName, Description, and CommandLine substrings.
references:
  - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-18
modified: 2023-02-07
tags:
  - attack.discovery
  - attack.t1046
  - attack.t1135
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \advanced_port_scanner
    - OriginalFileName|contains: advanced_port_scanner
    - Description|contains: Advanced Port Scanner
  selection_cli:
    CommandLine|contains|all:
      - /portable
      - /lng
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative use
  - Tools with similar commandline (very rare)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml
license: DRL-1.1
related:
  - id: 54773c5f-f1cc-4703-9126-2f797d96a69d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL