masscan is a very fast port scanner. Although this tool is not inherently malicious, it has been abused on hacked systems to port scan additional systems to attack and to enumerate internal networks.

Finding this software unexpectedly warrants an investigation.

rule masscan
{
	meta:
		description = "https://github.com/robertdavidgraham/masscan"

	strings:
		$a = " masscan -"
		$b = "https://github.com/robertdavidgraham/masscan"

	condition:
		any of them
}

YARA Rules Index