Chinese Hacktool Set - file portscanner.exe

Hunt Hypothesis

This detection identifies the presence of portscanner.exe, a known reconnaissance tool within the Chinese Hacktool set, which adversaries deploy to map network topology and identify active services during early intrusion phases. Proactively hunting for this artifact in Azure Sentinel is critical because its low-severity classification often leads to alert fatigue, allowing attackers to establish persistent footholds before triggering higher-priority incident responses.

YARA Rule

rule portscanner {
	meta:
		description = "Chinese Hacktool Set - file portscanner.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
	strings:
		$s0 = "PortListfNo" fullword ascii
		$s1 = ".533.net" fullword ascii
		$s2 = "CRTDLL.DLL" fullword ascii
		$s3 = "exitfc" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 25KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file portscanner.exe detection rule in an enterprise environment:

• Network Baseline Scans by SolarWinds NPM

  • Scenario: The SolarWinds Network Performance Monitor (NPM) agent executes a scheduled daily task to perform active network discovery and port availability checks. During this process, the agent dynamically generates or utilizes a local executable named portscanner.exe within its installation directory (C:\Program Files\SolarWinds\Orion) to map open ports on critical servers.
  • Filter/Exclusion: Create an exclusion for the file path C:\Program Files\SolarWinds\*\portscanner.exe and restrict alerts to only trigger if the process is launched by a non-privileged service account (e.g., exclude runs initiated by the SYSTEM or SolarWindsAgent user).

• Software Update Deployment via SCCM/MECM

  • Scenario: During a standard monthly patching cycle, Microsoft Endpoint Configuration Manager (SCCM) deploys a custom maintenance package to update legacy network utilities. The deployment script extracts a temporary utility named portscanner.exe into the software distribution cache (C:\Windows\CCMCache) to verify firewall rule integrity before applying updates to the production environment.
  • Filter/Exclusion: Exclude file paths containing \CCMCache\ or \SoftwareDistribution\ and filter for processes with a parent process of ccmexec.exe (the SCCM agent service), as this indicates a managed deployment rather than unscheduled user activity.

• IT Asset Inventory Audit by Lansweeper

  • Scenario: The IT Operations team runs the Lansweeper Discovery Agent to conduct an end-of-quarter hardware and software inventory audit. As part of its deep-scan routine, the agent invokes `port