T1046
Network Service Discovery
Containers · IaaS · Linux · macOS · Network Devices · Windowsnothing on this site yetT1046 on attack.mitre.org
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system. Within cloud environments, adversaries may attempt to discover services running on other cloud hosts.
how MITRE says to see it
Behavioral Detection Strategy for Network Service Discovery Across Platforms
- Detects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.
- Detects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.
- Detects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.
- Detects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.
what reduces it
- M1031 Network Intrusion Prevention. Use network intrusion detection/prevention systems to detect and prevent remote service scans.
- M1030 Network Segmentation. Ensure proper network segmentation is followed to protect critical servers and devices.
- M1042 Disable or Remove Feature or Program. Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.