Techniques › T1046
T1046 Network Service Discovery
discovery — Containers, IaaS, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
20
Sigma rules tagged attack.t1046
7
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.</p><p>Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.</p><p>Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as <code>dns-sd -B _ssh._tcp .</code>) to find other systems broadcasting the ssh service.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-32756 | Fortinet Multiple Products | secondary impact | Mapped | 2025-05-14 |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways | secondary impact | Mapped | 2025-01-08 |
| CVE-2023-38035 | Ivanti Sentry | secondary impact | Mapped | 2023-08-22 |
| CVE-2023-26360 | Adobe ColdFusion | secondary impact | Mapped | 2023-03-15 |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation | primary impact | Mapped | 2022-03-07 |
| CVE-2019-13608 | Citrix StoreFront Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2019-11634 | Citrix Workspace Application and Receiver for Windows | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0376 Behavioral Detection Strategy for Network Service Discovery Across Platforms v1.0
AN1057 WindowsDetects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.Tunable:
ScanRateThresholdKnownScannerExeListTimeWindowAN1058 LinuxDetects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.Tunable:PortScanThresholdToolPatternRegexExpectedScanSourcesAN1059 macOSDetects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.Tunable:MDNSServiceQueryPatternsUserContextScanToolListAN1060 ContainersDetects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.Tunable:ExecutablePathTimeWindowNetworkDestinationCount
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1046
Author: Alejandro Ortuno, oscd.community
· 2020-10-21 (modified 2023-09-26) · logsource: product=linux service=auditd · 3761e026-f259-44e6-8826-719ed8079408
Detects enumeration of local or remote network services.
Author: Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])
· 2020-10-21 (modified 2024-09-19) · logsource: product=linux category=process_creation · 3e102cd9-a70d-4a7a-9508-403963092f31
Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-02-05 · logsource: product=windows category=process_creation · 4fd6b1c7-19b8-4488-97f6-00f0924991a3
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-12-18 (modified 2023-02-07) · logsource: product=windows category=process_creation · 54773c5f-f1cc-4703-9126-2f797d96a69d
Detects the use of Advanced Port Scanner.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · 68b8547b-107f-43f3-97fb-900a7d63c190
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
Author: Alejandro Ortuno, oscd.community
· 2020-10-21 (modified 2021-11-27) · logsource: product=macos category=process_creation · 84bae5d4-b518-4ae0-b331-6d4afd34d00f
Detects enumeration of local or remote network services.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · 974be8d2-283e-4033-ab08-7505b84204d0
Detects instances where an OpenCanary node has been targeted by a SYN port scan.
Author: David Burkett (@signalblur)
· 2024-04-16 · logsource: product=linux category=process_creation · 97de11cd-4b67-4abf-9a8b-1020e670aa9e
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
Author: Georg Lauenstein (sure[secure])
· 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Author: yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-26 · logsource: product=windows category=process_creation · af688c76-4ce4-4309-bfdd-e896f01acf27
Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations.
This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.
Author: frack113
· 2021-12-10 (modified 2025-03-05) · logsource: product=windows category=network_connection · bef0bc5a-b9ae-425d-85c6-7b2d705980c6
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
Author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy
· 2020-05-12 (modified 2023-02-07) · logsource: product=windows category=process_creation · bef37fa2-f205-4a7b-b484-0759bfd5f86f
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Author: @d4ns4n_ (Wuerth-Phoenix)
· 2024-04-25 · logsource: product=windows category=process_creation · ca387a8e-1c84-4da3-9993-028b45342d30
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · d7553d7b-f485-479c-b192-cdac6edd83a4
Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · e8a677fd-248c-4eab-94df-de2f6f645884
Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · eae8c0c8-e5da-450a-9d7d-66aa56cd26b6
Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Author: frack113
· 2021-12-10 (modified 2023-12-11) · logsource: product=windows category=process_creation · f6ecd1cf-19b8-4488-97f6-00f0924991a3
Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation
Author: @ROxPinTeddy
· 2020-05-12 (modified 2022-11-29) · logsource: product=windows category=file_event · fed85bf9-e075-4280-9159-fbe8a023d6fa
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.