Procedure examples

HDoor scans to identify open ports on the victim.

MURKYTOP has the capability to scan for open ports on hosts in a connected network.

Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.

BADHATCH can check for open ports on a computer by establishing a TCP connection.

Hildegard has used masscan to look for kubelets in the internal Kubernetes network.

InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.

P.A.S. Webshell can scan networks for open ports and listening services.

Lucifer can scan for open ports including TCP ports 135 and 1433.

BlackEnergy has conducted port scans on a host.

Conficker scans for other machines to infect.

China Chopper's server component can spider authentication portals.

To collect data on the host's Wi-Fi connection history, LightSpy reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file`.It also utilizes Apple's CWWiFiClient API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.

Remsec has a plugin that can perform ARP scanning as well as port scanning.

Xbash can perform port scanning of TCP and UDP ports.

XTunnel is capable of probing the network for open ports.

Caterpillar WebShell has a module to use a port scanner on a system.

Royal can scan the network interfaces of targeted systems.

BlackByte Ransomware identifies remote systems via active directory queries for hostnames prior to launching remote ransomware payloads.

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.

MgBot includes modules for performing HTTP and server service scans.

SpeakUp checks for availability of specific ports on servers.

Cobalt Strike can perform port scans from an infected host.

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

ZxShell can launch port scans.

Industroyer uses a custom port scanner to map out a network.

HermeticWizard has the ability to scan ports on a compromised network.

SILENTTRINITY can scan for open ports on a compromised machine.

Empire can perform port scans from an infected host.

As part of load balancing FRP can set `healthCheck.type = "tcp"` or `healthCheck.type = "http"` to check service status on specific hosts with TCPing or an HTTP request.

PoshC2 can perform port scans from an infected host.

Brute Ratel C4 can conduct port scanning against targeted systems.

Peirates can initiate a port scan against a given IP address.

NBTscan can be used to scan IP networks.

Koadic can scan for open TCP ports on the target network.

Pupy has a built-in module for port scanning.