Description
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)
Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.
Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)
Nmap Tutorial
Read our in-depth pentesting guide related to this technique
Platforms
Mitigations (3)
Network Intrusion PreventionM1031
Use network intrusion detection/prevention systems to detect and prevent remote service scans.
Network SegmentationM1030
Ensure proper network segmentation is followed to protect critical servers and devices.
Disable or Remove Feature or ProgramM1042
Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.
Threat Groups (31)
| ID | Group | Context |
|---|---|---|
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as NetScan to enumerate network services in victim environments.(Citation: Micr... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used commercial tools, LOTL utilities, and appliances already present on the system for netw... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used a malware variant called WIDETONE to conduct port scans on specified subnets.(Citation: FireEye AP... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has used tcping.exe, similar to [Ping](https://attack.mitre.org/software/S0097), to probe port statu... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) performed network scanning on the network to search for open ports, services, OS finger-printing, and o... |
| G0019 | Naikon | [Naikon](https://attack.mitre.org/groups/G0019) has used the LadonGo scanner to scan target networks.(Citation: Bitdefender Naikon April 2021) |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the in... |
| G0077 | Leafminer | [Leafminer](https://attack.mitre.org/groups/G0077) scanned network services to search for vulnerabilities in the victim system.(Citation: Symantec Lea... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has used masscan to search for open Docker API ports and Kubernetes clusters.(Citation: Cado Security... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has leveraged [NBTscan](https://attack.mitre.org/software/S0590) to scan IP networks.(Citation:... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.(Citation: Talos Rocke Au... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used [CrackMapExec](https://attack.mitre.org/software/S0488) and a custom port scanner known as BLU... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDI... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) used <code>pr</code> and an openly available tool to scan for open ports on target systems.(Ci... |
| G0039 | Suckfly | [Suckfly](https://attack.mitre.org/groups/G0039) the victim's internal network for hosts with ports 8080, 5900, and 40 open.(Citation: Symantec Suckfl... |
| G0098 | BlackTech | [BlackTech](https://attack.mitre.org/groups/G0098) has used the SNScan tool to find other potential targets on victim networks.(Citation: Symantec Pal... |
| G0105 | DarkVishnya | [DarkVishnya](https://attack.mitre.org/groups/G0105) performed port scanning to obtain the list of active services.(Citation: Securelist DarkVishnya D... |
| G1039 | RedCurl | [RedCurl](https://attack.mitre.org/groups/G1039) has used netstat to check if port 4119 is open.(Citation: trendmicro_redcurl) |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has used port scanners to enumerate services on remote hosts.(Citation: Symantec Bilbug 2022) |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has used the <code>get -b <start ip> -e <end ip> -p</code> command for network scanning as well as a ... |
Associated Software (35)
| ID | Name | Type | Context |
|---|---|---|---|
| S0061 | HDoor | Malware | [HDoor](https://attack.mitre.org/software/S0061) scans to identify open ports on the victim.(Citation: Baumgartner Naikon 2015) |
| S0233 | MURKYTOP | Malware | [MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to scan for open ports on hosts in a connected network.(Citation: FireEye Peris... |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) can use a network scanning module to identify ICS-related ports.(Citation: Gigamon Berserk ... |
| S1081 | BADHATCH | Malware | [BADHATCH](https://attack.mitre.org/software/S1081) can check for open ports on a computer by establishing a TCP connection.(Citation: BitDefender BAD... |
| S0601 | Hildegard | Malware | [Hildegard](https://attack.mitre.org/software/S0601) has used masscan to look for kubelets in the internal Kubernetes network.(Citation: Unit 42 Hilde... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can scan the network for open ports and vulnerable instances of RDP and SMB protocols.(Citation:... |
| S0598 | P.A.S. Webshell | Malware | [P.A.S. Webshell](https://attack.mitre.org/software/S0598) can scan networks for open ports and listening services.(Citation: ANSSI Sandworm January 2... |
| S0532 | Lucifer | Malware | [Lucifer](https://attack.mitre.org/software/S0532) can scan for open ports including TCP ports 135 and 1433.(Citation: Unit 42 Lucifer June 2020) |
| S0089 | BlackEnergy | Malware | [BlackEnergy](https://attack.mitre.org/software/S0089) has conducted port scans on a host.(Citation: Securelist BlackEnergy Nov 2014) |
| S0608 | Conficker | Malware | [Conficker](https://attack.mitre.org/software/S0608) scans for other machines to infect.(Citation: SANS Conficker) |
| S0020 | China Chopper | Malware | [China Chopper](https://attack.mitre.org/software/S0020)'s server component can spider authentication portals.(Citation: FireEye Periscope March 2018) |
| S1185 | LightSpy | Malware | To collect data on the host's Wi-Fi connection history, [LightSpy](https://attack.mitre.org/software/S1185) reads the `/Library/Preferences/SystemConf... |
| S0125 | Remsec | Malware | [Remsec](https://attack.mitre.org/software/S0125) has a plugin that can perform ARP scanning as well as port scanning.(Citation: Kaspersky ProjectSaur... |
| S0341 | Xbash | Malware | [Xbash](https://attack.mitre.org/software/S0341) can perform port scanning of TCP and UDP ports.(Citation: Unit42 Xbash Sept 2018) |
| S0117 | XTunnel | Malware | [XTunnel](https://attack.mitre.org/software/S0117) is capable of probing the network for open ports.(Citation: Invincea XTunnel) |
| S0572 | Caterpillar WebShell | Malware | [Caterpillar WebShell](https://attack.mitre.org/software/S0572) has a module to use a port scanner on a system.(Citation: ClearSky Lebanese Cedar Jan ... |
| S1073 | Royal | Malware | [Royal](https://attack.mitre.org/software/S1073) can scan the network interfaces of targeted systems.(Citation: Cybereason Royal December 2022) |
| S1180 | BlackByte Ransomware | Malware | [BlackByte Ransomware](https://attack.mitre.org/software/S1180) identifies remote systems via active directory queries for hostnames prior to launchin... |
| S0583 | Pysa | Malware | [Pysa](https://attack.mitre.org/software/S0583) can perform network reconnaissance using the Advanced Port Scanner tool.(Citation: CERT-FR PYSA April ... |
| S1146 | MgBot | Malware | [MgBot](https://attack.mitre.org/software/S1146) includes modules for performing HTTP and server service scans.(Citation: Symantec Daggerfly 2023) |
References
- Apple Inc. (2013, April 23). Bonjour Overview. Retrieved October 11, 2021.
- CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
- Jaron Bradley. (2021, November 14). What does APT Activity Look Like on macOS?. Retrieved January 19, 2022.
Frequently Asked Questions
What is T1046 (Network Service Discovery)?
T1046 is a MITRE ATT&CK technique named 'Network Service Discovery'. It belongs to the Discovery tactic(s). Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common me...
How can T1046 be detected?
Detection of T1046 (Network Service Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1046?
There are 3 documented mitigations for T1046. Key mitigations include: Network Intrusion Prevention, Network Segmentation, Disable or Remove Feature or Program.
Which threat groups use T1046?
Known threat groups using T1046 include: BlackByte, Volt Typhoon, APT41, menuPass, APT32, Naikon, FIN6, Leafminer.