Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities available on the operating system or vendor software could also be used.[1]
| ID | Name | Description |
|---|---|---|
| C0028 | 2015 Ukraine Electric Power Attack |
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered operational assets once on the OT network. [2] [3] |
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries used |
| S0093 | Backdoor.Oldrea |
The Backdoor.Oldrea ICS malware plugin relies on Windows networking (WNet) to discover all the servers, including OPC servers, that are reachable by the compromised machine over the network. [5] |
| S1045 | INCONTROLLER |
INCONTROLLER can use the FINS (Factory Interface Network Service) protocol to scan for and obtain MAC address associated with Omron devices.[6][7] |
| S0604 | Industroyer |
Industroyer contains an OPC DA module that enumerates all OPC servers using the |
| ID | Mitigation | Description |
|---|---|---|
| M0814 | Static Network Configuration |
ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.[8][9] Examples of automation protocols with discovery capabilities include OPC UA Device Discovery[10], BACnet[11], and Ethernet/IP.[12] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0739 | Detection of Remote System Discovery | AN1872 |
Real-time monitoring identifies execution of network discovery tools (nmap, PLCScan, redpoint NSE scripts) or Industrial Control System (ICS)-specific scanners from an Industrial Control System (ICS) Windows host, from a process not associated with a recognized network management or engineering tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
| AN2132 |
Real-time monitoring identifies execution of network discovery tools on an Industrial Control System (ICS) Linux asset by a User Identifier (UID) that does not normally perform network scanning. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2171 |
Real-time network monitoring identifies a source generating Industrial Control System (ICS) discovery broadcasts or sequential connection attempts across the full IP range of a device subnet, from a source not in the approved engineering/Supervisory Control and Data Acquisition (SCADA) inventory. Documented in the PIPEDREAM/INCONTROLLER toolset's CODECALL module for EtherNet/IP device discovery. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2172 |
Real-time monitoring identifies Internet Control Message Protocol (ICMP) echo sweeps, Address Resolution Protocol (ARP) broadcast floods, or Industrial Control System (ICS)-specific discovery protocol packets from a host generating traffic to all IPs in a subnet in sequential order, a sweep pattern distinct from normal operational traffic to known device Internet Protocol (IP) addresses only. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |