Network Service Discovery is ATT&CK T1046. It belongs to the Discovery tactic and applies to Containers, IaaS, Linux, macOS, Network Devices and Windows.
Before an attacker can move through a network, they need to know what is in it. This technique is how they find out: listing the services running on remote hosts and on network devices, including ones that may be vulnerable to remote exploitation.
How attackers use it
MITRE describes common methods as port scans, vulnerability scans and wordlist scans, using tools that are brought onto a system. In cloud environments, adversaries may try to discover services running on other cloud hosts, and if the cloud is connected to an on-premises network, they may find services on non-cloud systems too.
On macOS, adversaries may use the native Bonjour application. The mDNSResponder daemon registers and advertises a host's services on the network automatically, so a multicast DNS query can find other systems that announce the ssh service, for example.
Procedure examples on the page include ping and the Advanced Port Scanner and Advanced IP Scanner used to list network devices, an open source port scanner used for detailed scans of hosts of interest, and, in two campaigns, an adversary using an AI coding assistant to enumerate ports and internal services.
Click through it at your own pace, or open it full screen.
How to detect it
The MITRE detection strategy has an analytic for each platform:
- Windows: processes performing network enumeration, such as port scans or service probing, found by correlating process creation, socket connections and sequential probing of destination IP addresses inside a time window.
- Linux: use of scanning tools or scripts that make rapid connections to multiple services or hosts, seen through auditd and netflow or packet capture telemetry.
- macOS: Bonjour-based mDNS enumeration, or use of tools such as dns-sd or nmap, to find active services through multicast probing or targeted scans.
- Containers and cloud: lateral discovery or container breakout attempts using netcat, curl or custom binaries to probe other services in the same namespace or VPC subnet.
The shape of a scan is what makes it visible: one source touching many destinations or many ports, in a short time, mostly with no data exchanged. A normal client talks to a handful of known servers. A scanner talks to everything once.
Data to collect: flow logs from your network and your cloud, firewall deny logs, endpoint connection logs with the process name, and DNS or mDNS logs. In a cloud account, VPC flow logs show rejected and accepted connections between instances. Alert on a single source with a high count of distinct destination ports or hosts within a few minutes, and tune thresholds for your vulnerability scanners, which look exactly the same and should be on an allow list by source address.
How to reduce the risk
MITRE lists three mitigations:
- Disable or remove features or programs. Make sure unnecessary ports and services are closed to prevent discovery and potential exploitation.
- Network intrusion prevention. Use detection and prevention systems to detect and prevent remote service scans.
- Network segmentation. Protect critical servers and devices with proper segmentation, so that a compromised workstation cannot even reach most services to scan them.
Segmentation does the most work here. A scan from a host that can reach only a few destinations returns almost nothing.
Check your own environment
Run the same view an attacker would get, from a normal workstation, using your own approved tool. Then review what is reachable that should not be.
Linux or macOS, list what is listening on this host and which process owns each port:
sudo ss -tlnp # Linux
sudo lsof -iTCP -sTCP:LISTEN -n -P # macOS and Linux
Windows PowerShell, the same for a Windows host:
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
Review each listener and decide whether it should exist. Anything you can turn off is one service fewer to find. Then:
- Do you know which of your hosts can reach your most sensitive servers?
- Do your flow logs let you ask which source touched the most distinct ports last night?
- Are your own vulnerability scanners on an allow list so their noise does not hide a real one?
Quick check
What does a port scan look like in flow logs?
One source contacting many destination hosts or many ports in a short window, usually with little or no data exchanged.
Which MITRE mitigation limits what a compromised host can even see?
Network segmentation, which protects critical servers and devices so that a compromised host cannot reach most services.
