Scanning IP Blocks (T1595.001) is a sub-technique of Active Scanning in the reconnaissance tactic. The platform in MITRE ATT&CK is PRE, because it happens before an adversary has any foothold.
Organizations usually get public addresses in blocks, which are ranges of sequential addresses. That makes your footprint easy to enumerate. If someone knows one of your addresses, the neighbors are a short step away.
How attackers use it
MITRE says adversaries scan IP blocks to gather victim network information, such as which addresses are in use and more detailed information about the hosts assigned to them.
The scans can be simple or detailed. At the simple end are pings, meaning ICMP requests and responses. At the detailed end are scans that reveal host software and versions through server banners or other network artifacts.
What they learn can lead to other reconnaissance (searching open websites or technical databases), to building or obtaining capabilities, and to initial access through External Remote Services.
How to detect it
MITRE's analytic is to monitor the content of network traffic for patterns associated with scanning: repeated connection attempts, unusual scanning behavior, and probing across multiple IP addresses in your range. It also says to watch for uncommon data flows, and to treat processes that use the network without normally doing so, or that have never been seen before, as suspicious.
In practice, that means looking at flow and firewall logs for one source touching many of your addresses in a short time, and at internal hosts that start probing neighbors.
Treat this as context, not as an alarm. Internet-wide scanning is constant. The signal worth acting on is a scan that precedes something more specific against the same assets.
How to reduce the risk
MITRE's mitigation, Pre-compromise, says this cannot be easily mitigated with preventive controls because it is outside the scope of enterprise defenses. The focus should be on minimizing the amount and sensitivity of data available to external parties.
For IP blocks, that comes down to a few plain steps:
- Keep an inventory of every public address you hold and what is behind it.
- Shut down or remove anything that does not need to be reachable.
- Avoid banners and responses that reveal exact software versions where you can.
- Patch services that must stay public.
Check your own environment
On a Linux host you own, list listening sockets (iproute2):
ss -tulpn
Then compare that list with your inventory. Anything unexpected is where to start.
Quick check
Why is a ping sweep still useful to an adversary?
It shows which addresses in an allocated block are in use, which narrows where to look next.
