Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution
Flags Windows execution of Nmap/Zenmap (nmap.exe or zennmap.exe) used for remote service discovery.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-10
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of Nmap or Zenmap on Windows by matching process creation events for nmap.exe or zennmap.exe. Attackers commonly use these tools to enumerate remote services and ports, which can reveal vulnerable targets for later exploitation. The detection relies on Windows process creation telemetry, including the executed image path and OriginalFileName fields.
Reporting behind it
- nmap.orghttps://nmap.org/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution"
id: 83b66400-463b-4353-97b7-283b1a7e1247
status: test
description: This rule identifies execution of Nmap or Zenmap on Windows by matching process creation events for nmap.exe or zennmap.exe. Attackers commonly use these tools to enumerate remote services and ports, which can reveal vulnerable targets for later exploitation. The detection relies on Windows process creation telemetry, including the executed image path and OriginalFileName fields.
references:
- https://nmap.org/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-12-11
tags:
- attack.discovery
- attack.t1046
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \nmap.exe
- \zennmap.exe
- OriginalFileName:
- nmap.exe
- zennmap.exe
condition: selection
falsepositives:
- Legitimate administrator activity
level: medium
license: DRL-1.1
related:
- id: f6ecd1cf-19b8-4488-97f6-00f0924991a3
type: derived