| ID | Name |
|---|---|
| T0846.001 | Port Scan |
| T0846.002 | Broadcast Discovery |
| T0846.003 | Multicast Discovery |
Adversaries may perform multicast discovery requests which is when one system or device sends messages to all systems and devices in a pre-defined group on a network (or subnet) and then waits for a response. If a response is received that means the system or device that responded is live and can communicate over that protocol. Multicast discovery tends to be stealthier than broadcast discovery because every system or device on the network (or subnet) is not being messaged.
One common OT protocol that has a multicast discovery mechanism is the Process Field Network (PROFINET) Discovery and Configuration Protocol (DCP) with its Identify All requests.[1]
| ID | Name | Description |
|---|---|---|
| S1045 | INCONTROLLER |
INCONTROLLER can perform a UDP multicast scan of UDP port 27127 to identify Schneider PLCs that use that port for the NetManage protocol.[2][3] |
| ID | Mitigation | Description |
|---|---|---|
| M0930 | Network Segmentation |
Ensure proper network segmentation is followed to protect critical servers and devices. |
| M0814 | Static Network Configuration |
ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.[4][5] Examples of automation protocols with discovery capabilities include OPC UA Device Discovery [6], BACnet[7], and Ethernet/IP.[8] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0909 | Detection of Multicast Discovery | AN2052 |
Monitor for anomalies related to discovery related ICS functions, including devices that have not previously used these functions or for functions being sent to many outstations. Monitor for new ICS protocol connections to existing assets or for device scanning (i.e., a host connecting to many devices) over ICS and enterprise protocols (e.g., ICMP, DCOM, WinRM). For added context on adversary enterprise procedures and background see Remote System Discovery. |