Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution

Flags Windows execution of Nmap/Zenmap (nmap.exe or zennmap.exe) used for remote service discovery.

FreeUnreviewedSigmamediumv1

windows-process-creation-nmap-zenmap-nmap-exe-or-zennmap-exe-execution-f6ecd1cf

title: "Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution"
id: 83b66400-463b-4353-97b7-283b1a7e1247
status: test
description: This rule identifies execution of Nmap or Zenmap on Windows by matching process creation events for nmap.exe or zennmap.exe. Attackers commonly use these tools to enumerate remote services and ports, which can reveal vulnerable targets for later exploitation. The detection relies on Windows process creation telemetry, including the executed image path and OriginalFileName fields.
references:
  - https://nmap.org/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-12-11
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \nmap.exe
        - \zennmap.exe
    - OriginalFileName:
        - nmap.exe
        - zennmap.exe
  condition: selection
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: f6ecd1cf-19b8-4488-97f6-00f0924991a3
    type: derived

What it detects

This rule identifies execution of Nmap or Zenmap on Windows by matching process creation events for nmap.exe or zennmap.exe. Attackers commonly use these tools to enumerate remote services and ports, which can reveal vulnerable targets for later exploitation. The detection relies on Windows process creation telemetry, including the executed image path and OriginalFileName fields.

Known false positives

Legitimate administrator activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.