Network Service Scanning

Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system.

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.

ID: T1046

Sub-techniques: No sub-techniques

Tactic: Discovery

Platforms: AWS, Azure, GCP, Linux, Windows, macOS

Permissions Required: Administrator, SYSTEM, User

Data Sources: Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process use of network

CAPEC ID: CAPEC-300

Contributors: Praetorian

Version: 2.1

Created: 31 May 2017

Last Modified: 11 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT32	APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.^[23]
APT39	APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning ^[27]^[28]
APT41	APT41 used a malware variant called WIDETONE to conduct port scans on the specified subnets.^[13]
BlackEnergy	BlackEnergy has conducted port scans on a host.^[7]
China Chopper	China Chopper's server component can spider authentication portals.^[10]
Cobalt Group	Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.^[17]^[18]^[19]
Cobalt Strike	Cobalt Strike can perform port scans from an infected host.^[2]
DarkVishnya	DarkVishnya performed port scanning to obtain the list of active services.^[31]
Empire	Empire can perform port scans from an infected host.^[4]
FIN6	FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.^[22]
HDoor	HDoor scans to identify open ports on the victim.^[6]
Koadic	Koadic can scan for open TCP ports on the target network.^[1]
Leafminer	Leafminer scanned network services to search for vulnerabilities in the victim system.^[16]
menuPass	menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.^[26]
MURKYTOP	MURKYTOP has the capability to scan for open ports on hosts in a connected network.^[10]
OilRig	OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.^[21]
PoshC2	PoshC2 can perform port scans from an infected host.^[5]
Pupy	Pupy has a built-in module for port scanning.^[3]
Ramsay	Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.^[15]
Remsec	Remsec has a plugin that can perform ARP scanning as well as port scanning.^[8]
Rocke	Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.^[32]^[33]
SpeakUp	SpeakUp checks for availability of specific ports on servers.^[12]
Suckfly	Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.^[20]
Threat Group-3390	Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.^[24]^[25]
Tropic Trooper	Tropic Trooper used `pr` and an openly available tool to scan for open ports on target systems.^[29]^[30]
Xbash	Xbash can perform port scanning of TCP and UDP ports.^[9]
XTunnel	XTunnel is capable of probing the network for open ports.^[11]
ZxShell	ZxShell can launch port scans.^[13]^[14]

Mitigations

Mitigation	Description
Disable or Remove Feature or Program	Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.
Network Intrusion Prevention	Use network intrusion detection/prevention systems to detect and prevent remote service scans.
Network Segmentation	Ensure proper network segmentation is followed to protect critical servers and devices.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Normal, benign system and network events from legitimate remote service scanning may be uncommon, depending on the environment and how they are used. Legitimate open port and vulnerability scanning may be conducted within the environment and will need to be deconflicted with any detection capabilities developed. Network intrusion detection systems can also be used to identify scanning activity. Monitor for process use of the networks and inspect intra-network flows to detect port scans.

Network Service Scanning

Procedure Examples

Mitigations

Detection

References