t1046-network-service-discovery

name	T1046_network-service-discovery
description	Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1046","discovery","containers","iaas","linux","macos","network-devices","windows"]
technique_id	T1046
tactic	discovery
all_tactics	["discovery"]
platforms	["Containers","IaaS","Linux","macOS","Network Devices","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1046
tech_stack	["containers","cloud","linux","macos","network devices","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1046 Network Service Discovery

High-Level Description

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.

Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Containers, IaaS, Linux, macOS, Network Devices, Windows

What to Check

• Identify if Network Service Discovery technique is applicable to target environment
• Check Containers systems for indicators of Network Service Discovery
• Check IaaS systems for indicators of Network Service Discovery
• Check Linux systems for indicators of Network Service Discovery
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Port Scan

Scan ports to check for listening ports.

Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.

Supported Platforms: linux, macos

for port in {1..65535};  (2>/dev/null  >/dev/tcp/#{host}/) &&  port  is open ;