| ID | Name |
|---|---|
| T0846.001 | Port Scan |
| T0846.002 | Broadcast Discovery |
| T0846.003 | Multicast Discovery |
Adversaries may perform a port scan on a system, device, or network to identify live hosts, enumerate open ports and running services, identify operating systems, and map out the network.[1] The results of a port scan may inform adversary Discovery, Lateral Movement, and vulnerability exploitation decisions (Exploitation for Evasion, Exploitation for Privilege Escalation, Exploitation of Remote Services).
Some common tools for executing a port scan include nmap, netcat, and the Advanced Port Scanner.
| ID | Name | Description |
|---|---|---|
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries used Advanced Port Scanner and Advanced IP Scanner to conduct remote system discovery activities.[2] |
| S1045 | INCONTROLLER |
INCONTROLLER has the ability to perform scans for TCP port 4840 to identify devices running OPC UA servers.[3] |
| S0604 | Industroyer |
The Industroyer IEC 61850 payload component has the ability to discover relevant devices in the infected host's network subnet by attempting to connect on port 102.[4] |
| S1006 | PLC-Blaster |
PLC-Blaster scans the network to find other Siemens S7 PLC devices to infect. It locates these devices by checking for a service listening on TCP port 102.[5] |
| ID | Mitigation | Description |
|---|---|---|
| M0931 | Network Intrusion Prevention |
Use network intrusion detection/prevention systems to detect and prevent port scans. |
| M0930 | Network Segmentation |
Ensure proper network segmentation is followed to protect critical systems and devices. |
| M0814 | Static Network Configuration |
ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.[6][7] Examples of automation protocols with discovery capabilities include OPC UA Device Discovery[8], BACnet[9], and Ethernet/IP.[10] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0907 | Detection of Port Scan | AN2050 |
Monitor for new processes engaging in scanning activity or connecting to multiple systems by correlating process creation network data. Monitor for hosts enumerating network connected resources using non-ICS enterprise protocols. |