Skip to content

T1046 Network Service Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.2

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.

Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.13

Item Value
ID T1046
Sub-techniques
Tactics TA0007
Platforms Containers, IaaS, Linux, Network Devices, Windows, macOS
Version 3.2
Created 31 May 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G1030 Agrius Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.52
G0050 APT32 APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.65
G0087 APT39 APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.4445
G0096 APT41 APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.24
S0093 Backdoor.Oldrea Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.14
G0135 BackdoorDiplomacy BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.74
S1081 BADHATCH BADHATCH can check for open ports on a computer by establishing a TCP connection.22
G1043 BlackByte BlackByte has used tools such as NetScan to enumerate network services in victim environments.47
S1180 BlackByte Ransomware BlackByte Ransomware identifies remote systems via active directory queries for hostnames prior to launching remote ransomware payloads.26
S0089 BlackEnergy BlackEnergy has conducted port scans on a host.20
G0098 BlackTech BlackTech has used the SNScan tool to find other potential targets on victim networks.46
S1063 Brute Ratel C4 Brute Ratel C4 can conduct port scanning against targeted systems.12
C0018 C0018 During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.89
C0027 C0027 During C0027, used RustScan to scan for open ports on targeted ESXi appliances.88
S0572 Caterpillar WebShell Caterpillar WebShell has a module to use a port scanner on a system.41
G0114 Chimera Chimera has used the get -b -e -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.68
S0020 China Chopper China Chopper’s server component can spider authentication portals.25
G0080 Cobalt Group Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.808182
S0154 Cobalt Strike Cobalt Strike can perform port scans from an infected host.292830
S0608 Conficker Conficker scans for other machines to infect.36
C0004 CostaRicto During CostaRicto, the threat actors employed nmap and pscan to scan target environments.85
G0105 DarkVishnya DarkVishnya performed port scanning to obtain the list of active services.55
G1003 Ember Bear Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.84
S0363 Empire Empire can perform port scans from an infected host.5
G1016 FIN13 FIN13 has utilized nmap for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.5453
G0037 FIN6 FIN6 used publicly available tools (including Microsoft’s built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.70
G0117 Fox Kitten Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.7677
S1144 FRP As part of load balancing FRP can set healthCheck.type = "tcp" or healthCheck.type = "http" to check service status on specific hosts with TCPing or an HTTP request.10
S0061 HDoor HDoor scans to identify open ports on the victim.37
S0698 HermeticWizard HermeticWizard has the ability to scan ports on a compromised network.33
S0601 Hildegard Hildegard has used masscan to look for kubelets in the internal Kubernetes network.21
C0038 HomeLand Justice During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.8687
G1032 INC Ransom INC Ransom has used NETSCAN.EXE for internal reconnaissance.6766
S0604 Industroyer Industroyer uses a custom port scanner to map out a network.15
S0260 InvisiMole InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.38
S0250 Koadic Koadic can scan for open TCP ports on the target network.9
G0032 Lazarus Group Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.57
G0077 Leafminer Leafminer scanned network services to search for vulnerabilities in the victim system.58
S1185 LightSpy To collect data on the host’s Wi-Fi connection history, LightSpy reads the /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file.It also utilizes Apple’s CWWiFiClient API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.35
G0030 Lotus Blossom Lotus Blossom has used port scanners to enumerate services on remote hosts.75
S0532 Lucifer Lucifer can scan for open ports including TCP ports 135 and 1433.40
G0059 Magic Hound Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.62
G1051 Medusa Group Medusa Group has the capability to use living off the land (LOTL) binaries to perform network enumeration.78 Medusa Group has also utilized the publicly available scanning tool SoftPerfect Network Scanner (netscan.exe) to discover device hostnames and network services.79
G0045 menuPass menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.48
S1146 MgBot MgBot includes modules for performing HTTP and server service scans.34
S0233 MURKYTOP MURKYTOP has the capability to scan for open ports on hosts in a connected network.25
G0129 Mustang Panda Mustang Panda has leveraged NBTscan to scan IP networks.51
G0019 Naikon Naikon has used the LadonGo scanner to scan target networks.61
S0590 NBTscan NBTscan can be used to scan IP networks.67
G0049 OilRig OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.56
C0014 Operation Wocao During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.90
S0598 P.A.S. Webshell P.A.S. Webshell can scan networks for open ports and listening services.31
S0683 Peirates Peirates can initiate a port scan against a given IP address.8
S0378 PoshC2 PoshC2 can perform port scans from an infected host.13
S0192 Pupy Pupy has a built-in module for port scanning.4
S0583 Pysa Pysa can perform network reconnaissance using the Advanced Port Scanner tool.42
S0458 Ramsay Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.1617
G1039 RedCurl RedCurl has used netstat to check if port 4119 is open.83
S0125 Remsec Remsec has a plugin that can perform ARP scanning as well as port scanning.39
G0106 Rocke Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.6364
S1073 Royal Royal can scan the network interfaces of targeted systems.18
S0692 SILENTTRINITY SILENTTRINITY can scan for open ports on a compromised machine.11
S0374 SpeakUp SpeakUp checks for availability of specific ports on servers.19
G0039 Suckfly Suckfly the victim’s internal network for hosts with ports 8080, 5900, and 40 open.69
G0139 TeamTNT TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.712172 TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.73
G0027 Threat Group-3390 Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.4950
G0081 Tropic Trooper Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.5960
G1017 Volt Typhoon Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.43
S0341 Xbash Xbash can perform port scanning of TCP and UDP ports.27
S0117 XTunnel XTunnel is capable of probing the network for open ports.32
S0412 ZxShell ZxShell can launch port scans.2423

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.
M1031 Network Intrusion Prevention Use network intrusion detection/prevention systems to detect and prevent remote service scans.
M1030 Network Segmentation Ensure proper network segmentation is followed to protect critical servers and devices.

References

  1. Apple Inc. (2013, April 23). Bonjour Overview. Retrieved October 11, 2021. ↩

  2. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. ↩

  3. Jaron Bradley. (2021, November 14). What does APT Activity Look Like on macOS?. Retrieved January 19, 2022. ↩

  4. Nicolas Verdier. (n.d.). Retrieved January 29, 2018. ↩

  5. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩

  6. Bezroutchko, A. (2019, November 19). NBTscan man page. Retrieved March 17, 2021. ↩

  7. SecTools. (2003, June 11). NBTscan. Retrieved March 17, 2021. ↩

  8. InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022. ↩

  9. Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024. ↩

  10. fatedier. (n.d.). What is frp?. Retrieved July 10, 2024. ↩

  11. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  12. Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023. ↩

  13. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  14. Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021. ↩

  15. Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020. ↩

  16. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020. ↩

  17. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel’s infiltration and isolation network. Retrieved March 24, 2021. ↩

  18. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023. ↩

  19. Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019. ↩

  20. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016. ↩

  21. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. ↩↩

  22. Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021. ↩

  23. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩

  24. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩↩

  25. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. ↩↩

  26. Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024. ↩

  27. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018. ↩

  28. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024. ↩

  29. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. ↩

  30. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  31. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021. ↩

  32. Belcher, P.. (2016, July 28). Tunnel of Gov: DNC Hack and the Russian XTunnel. Retrieved August 3, 2016. ↩

  33. ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022. ↩

  34. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024. ↩

  35. Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025. ↩

  36. Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021. ↩

  37. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019. ↩

  38. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. ↩

  39. Kaspersky Lab’s Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016. ↩

  40. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020. ↩

  41. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  42. CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021. ↩

  43. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  44. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019. ↩

  45. Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020. ↩

  46. Threat Intelligence. (2020, September 29). Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors. Retrieved March 25, 2022. ↩

  47. Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024. ↩

  48. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017. ↩

  49. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩

  50. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019. ↩

  51. Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025. ↩

  52. Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024. ↩

  53. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023. ↩

  54. Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023. ↩

  55. Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020. ↩

  56. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017. ↩

  57. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021. ↩

  58. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018. ↩

  59. Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019. ↩

  60. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020. ↩

  61. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021. ↩

  62. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023. ↩

  63. Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020. ↩

  64. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019. ↩

  65. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  66. SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024. ↩

  67. SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024. ↩

  68. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. ↩

  69. DiMaggio, J. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016. ↩

  70. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024. ↩

  71. Cado Security. (2020, August 16). Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021. ↩

  72. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  73. Quist, N. (2020, October 5). Black-T: New Cryptojacking Variant from TeamTNT. Retrieved September 22, 2021. ↩

  74. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021 ↩

  75. Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025. ↩

  76. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  77. ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020. ↩

  78. Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025. ↩

  79. Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025. ↩

  80. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018. ↩

  81. Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018. ↩

  82. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018. ↩

  83. Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024. ↩

  84. US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024. ↩

  85. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. ↩

  86. CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024. ↩

  87. MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024. ↩

  88. Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023. ↩

  89. Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023. ↩

  90. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩