Execution of a port or network service scanning utility

Siemphony@siemphonymediumT1046unverifiedPlaybook · Discovery and enumeration

AN1057 is a rate analytic — it counts unique destination addresses and ports inside MITRE's TimeWindow and compares the result against ScanRateThreshold — and none of that survives into single-event Sigma. What is left, and all this rule claims, is that a scanning utility was launched on the host: it does not observe a scan, does not know whether one host or a whole /16 was probed, and is silent on scanning done from PowerShell sockets or from a renamed binary, because the selection anchors on the image name. MITRE's KnownScannerExeList knob is an allowlist of scanners IT is permitted to run; the list below is the authored inverse of it, restricted to binaries that do their own scanning rather than launchers that hand off to another process. The level is deliberately medium and not higher: in any estate that uses one of these for inventory this is a daily event, and treating it as an alert rather than a hunting lead is how the rule gets turned off. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0376, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Execution of a port or network service scanning utility2id: 5161327d-a49b-49de-879f-5ff2a84b61703status: experimental4description: |5  AN1057 is a rate analytic — it counts unique destination addresses and ports6  inside MITRE's TimeWindow and compares the result against ScanRateThreshold —7  and none of that survives into single-event Sigma. What is left, and all this8  rule claims, is that a scanning utility was launched on the host: it does not9  observe a scan, does not know whether one host or a whole /16 was probed, and10  is silent on scanning done from PowerShell sockets or from a renamed binary,11  because the selection anchors on the image name. MITRE's KnownScannerExeList12  knob is an allowlist of scanners IT is permitted to run; the list below is13  the authored inverse of it, restricted to binaries that do their own scanning14  rather than launchers that hand off to another process. The level is15  deliberately medium and not higher: in any estate that uses one of these for16  inventory this is a daily event, and treating it as an alert rather than a17  hunting lead is how the rule gets turned off.18  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0376, not hand-written and not tested by its author. Any lab result is on this rule's own page.19references:20  - https://attack.mitre.org/techniques/T104621  - https://attack.mitre.org/detectionstrategies/DET037622author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)23date: 2026-08-1624tags:25  - attack.discovery26  - attack.t104627logsource:28  category: process_creation29  product: windows30detection:31  selection:32    Image|endswith:33      - '\nmap.exe'34      - '\ncat.exe'35      - '\masscan.exe'36      - '\rustscan.exe'37      - '\naabu.exe'38      - '\fscan.exe'39      - '\netscan.exe'40      - '\nbtscan.exe'41      - '\advanced_ip_scanner.exe'42      - '\advanced_port_scanner.exe'43      - '\portqry.exe'44  condition: selection45falsepositives:46  - "Sanctioned inventory and vulnerability scanning. Advanced IP Scanner and the SoftPerfect scanner are ordinary helpdesk tools in many organisations, and a vulnerability-management agent that shells out to nmap matches on every scheduled sweep. This is precisely the noise MITRE parks in the KnownScannerExeList knob, and that knob has to be populated with the local truth before this rule is worth routing to an analyst."47  - "Authorised penetration tests and red-team engagements, which produce the exact process this rule selects and are indistinguishable from an intruder at the process-creation event."48  - "Network engineers using ncat or portqry interactively to check whether one service on one host is reachable. That is a single connection rather than a scan, but the process event is identical because this rule never sees the connections at all."49  - "Portable copies of these tools bundled inside vendor support packages and diagnostic collectors, which run them once from a temporary directory during a support case."50level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\nmap.exe" or FolderPath endswith "\\ncat.exe" or FolderPath endswith "\\masscan.exe" or FolderPath endswith "\\rustscan.exe" or FolderPath endswith "\\naabu.exe" or FolderPath endswith "\\fscan.exe" or FolderPath endswith "\\netscan.exe" or FolderPath endswith "\\nbtscan.exe" or FolderPath endswith "\\advanced_ip_scanner.exe" or FolderPath endswith "\\advanced_port_scanner.exe" or FolderPath endswith "\\portqry.exe")

Splunk · SPL

Run this as a search.

index=* (Image="*\\nmap.exe" OR Image="*\\ncat.exe" OR Image="*\\masscan.exe" OR Image="*\\rustscan.exe" OR Image="*\\naabu.exe" OR Image="*\\fscan.exe" OR Image="*\\netscan.exe" OR Image="*\\nbtscan.exe" OR Image="*\\advanced_ip_scanner.exe" OR Image="*\\advanced_port_scanner.exe" OR Image="*\\portqry.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\nmap.exe" OR TO_LOWER(process.executable) LIKE "*\\\\ncat.exe" OR TO_LOWER(process.executable) LIKE "*\\\\masscan.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rustscan.exe" OR TO_LOWER(process.executable) LIKE "*\\\\naabu.exe" OR TO_LOWER(process.executable) LIKE "*\\\\fscan.exe" OR TO_LOWER(process.executable) LIKE "*\\\\netscan.exe" OR TO_LOWER(process.executable) LIKE "*\\\\nbtscan.exe" OR TO_LOWER(process.executable) LIKE "*\\\\advanced_ip_scanner.exe" OR TO_LOWER(process.executable) LIKE "*\\\\advanced_port_scanner.exe" OR TO_LOWER(process.executable) LIKE "*\\\\portqry.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\nmap\.exe$|\\ncat\.exe$|\\masscan\.exe$|\\rustscan\.exe$|\\naabu\.exe$|\\fscan\.exe$|\\netscan\.exe$|\\nbtscan\.exe$|\\advanced_ip_scanner\.exe$|\\advanced_port_scanner\.exe$|\\portqry\.exe$)</field>    <description>Execution of a port or network service scanning utility</description>    <mitre>      <id>T1046</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: network_service_discovery
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 5161327d-a49b-49de-879f-5ff2a84b6170

ATT&CKT1046

T1046Network Service Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1046, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate KnownScannerExeList with your local truth first — the knob is
Add the OriginalFileName arm before anyone treats a quiet dashboard as good
For the actual scan you need the EventID 3 aggregation Sigma cannot express:

Declared by the author

Sanctioned inventory and vulnerability scanning. Advanced IP Scanner and the SoftPerfect scanner are ordinary helpdesk tools in many organisations, and a vulnerability-management agent that shells out to nmap matches on every scheduled sweep. This is precisely the noise MITRE parks in the KnownScannerExeList knob, and that knob has to be populated with the local truth before this rule is worth routing to an analyst.
Authorised penetration tests and red-team engagements, which produce the exact process this rule selects and are indistinguishable from an intruder at the process-creation event.
Network engineers using ncat or portqry interactively to check whether one service on one host is reachable. That is a single connection rather than a scan, but the process event is identical because this rule never sees the connections at all.
Portable copies of these tools bundled inside vendor support packages and diagnostic collectors, which run them once from a temporary directory during a support case.

Lessonnetwork service discovery

network service discoveryAI draft — unreviewed

01 · What this rule detects

The launch of a known port- or service-scanning utility. Nothing more. MITRE's analytic AN1057 is a rate analytic: it counts unique destination addresses and ports inside a TimeWindow and compares the result against a ScanRateThreshold. Sigma is single-event — no aggregation, no time window — so none of that survives. What is left is the process-creation precursor: a scanning tool started on the host. It does not observe a scan, does not know whether one host or a whole /16 was probed, and fires on nmap.exe checking a single port with no scan at all. The reviewer's summary is the honest one: an inventory rule wearing a discovery technique's title. Learn the shape — a great many published detections are this shape and do not admit it.

02 · Telemetry you need

Sysmon EventID 1, copied verbatim from AN1057's first log source.
The Sentinel rendering targets EventID == 4688 / NewProcessName instead.
AN1057's connection legs (Sysmon EventID 3 and 22) are a different log source

03 · How the logic works

One field, one modifier, eleven values. MITRE's KnownScannerExeList knob is an allowlist of scanners IT is permitted to run; this list is the authored inverse of it. The leading \ forces a path separator before the filename, so mycompany-nmap.exe does not match, and endswith means a portable copy in %TEMP% matches like an installed one. One inclusion decision is worth copying: `zenmap.exe` is deliberately absent. Zenmap is a Python GUI that hands the scanning to nmap.exe, so selecting it would add a term on a process that never scans. Always ask whether the binary you are naming is the one that performs the behaviour your log source records. Now the finding. The rule keys on Image alone and the description concedes that renaming defeats it. But Sysmon EventID 1 — the log source it chose — carries `OriginalFileName`, read from the PE version resource, which survives a rename for nmap.exe, ncat.exe and masscan.exe. A free mitigation, in the exact feed the rule was written against, went unused. An OR-ed second selection closes the one-line-rename bypass at no cost:

Say that this arm exists on Sysmon EventID 1 only; on 4688 the rule stays name-only. The general lesson: before accepting "renaming defeats this" as a limitation, check what else the same event already gives you for free. Filename lists also drift. fscan also ships fscan64.exe; Advanced IP Scanner runs as advanced_ip_scanner_console.exe from the CLI and under a versioned portable filename when not installed. Also absent: ipscan.exe, nping.exe. And trace what a real scan often looks like on Windows: 1..254 | %{Test-NetConnection 10.0.0.$_ -Port 445}, a Python socket sweep, net view /domain, a Cobalt Strike portscan BOF. All are T1046, and all produce zero hits here, because none creates a process on the list.

04 · Common false positives

Sanctioned inventory and vulnerability scanning. Advanced IP Scanner and the
Authorised penetration tests — the same process, indistinguishable here.
Network engineers checking one service with ncat or portqry.
Unrelated `netscan.exe` binaries. The name is generic enough that printer,

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0376 and never executed against a single log line.
tier_2: run it over history, learn which of the eleven names your estate produces, drop the level to match, add the OriginalFileName arm.
tier_3: is the rate analytic, which is not a Sigma rule at all. Until then, a quiet result is not evidence that no scanning occurred.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/5161327d-a49b-49de-879f-5ff2a84b6170

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Execution of a port or network service scanning utility

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it