nmap.exe
Sources: 300M+ executions observed in the wild.
Summary
Network Mapper. The most widely-used network scanning tool. Port scanning, service detection, OS fingerprinting, and vulnerability scanning. Presence on a non-security-team endpoint is a strong indicator of compromise or unauthorized activity.
nmap.exe is the 2364th most commonly executed Windows program in EchoTrail's dataset, observed 195 times across enterprise environments. It typically runs from C:\Program Files (x86)\Nmap and it is most often launched by cmd.exe.
Get this in your tools
The same record for nmap.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/nmap.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\Nmap100%
Top Hashes (SHA256)
- 54f26492ff3fb5120f1cd95e6da1c103c17ea7fd06570f907265e411eec67c7593.85%
- f7812c926628e084e5e8d76b6d3178f69e03e3395cb549c744ffa7e57ba2199b4.62%
- f6cbd17cfc0e92776f60613dd19444816832085c135b2a651c8e8e2dc4062b261.03%
- 1c15c02aef7aa716f254c5141c91fc9eb3d7c9a407a1c1ae85ef9acb34c9bbcd0.51%
Process Ancestry
Top Grandparents
- explorer.exe96.84%
- RuntimeBroker.exe2.11%
- svchost.exe0.53%
- userinit.exe0.53%
Top Parents
- cmd.exe77.44%
- zenmap.exe21.54%
- explorer.exe0.51%
- RuntimeBroker.exe0.51%
Top Children
- conhost.exe61.11%
- net.exe38.89%
Security Analysis
What does nmap.exe normally do?
Not a Windows built-in. Must be explicitly installed. Legitimate use limited to security teams, network administrators, and authorized penetration testers.
When is nmap.exe suspicious?
Presence on non-security-team endpoints. Scanning internal network ranges. Scanning large IP ranges. Running from temp directories or user profiles. Execution by non-admin users.
How do attackers abuse nmap.exe?
NETWORK RECONNAISSANCE: Attackers install or bring nmap to compromised hosts for internal network scanning. - Port scanning to identify running services and open ports - Service version detection (-sV) to find vulnerable software - OS fingerprinting (-O) to identify target operating systems - Script scanning (--script) for vulnerability detection Occasionally brought in as a portable binary during post-exploitation.
Detection guidance
HIGH-CONFIDENCE: - nmap.exe execution on non-security-team endpoints - nmap.exe installed on a system without authorized security tools - nmap.exe scanning internal network ranges DATA SOURCES: Process creation (Sysmon 1), network connections (Sysmon 3)
False positive notes
Security teams running authorized scans. Penetration testers during engagements. Network monitoring tools that use nmap for discovery.
Related Processes
Ask Rocky about nmap.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for nmap.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.