Network Service Discovery

Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.^[4]

APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.^[5]

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.^[6][7]

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.^[8]

Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.^[9]

BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.^[10]

BADHATCH can check for open ports on a computer by establishing a TCP connection.^[11]

BlackEnergy has conducted port scans on a host.^[12]

BlackTech has used the SNScan tool to find other potential targets on victim networks.^[13]

Brute Ratel C4 can conduct port scanning against targeted systems.^[14]

During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.^[15]

During C0027, used RustScan to scan for open ports on targeted ESXi appliances.^[16]

Caterpillar WebShell has a module to use a port scanner on a system.^[17]

Chimera has used the get -b -e -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.^[18]

China Chopper's server component can spider authentication portals.^[19]

Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.^[20][21][22]

Cobalt Strike can perform port scans from an infected host.^[23][24][25]

Conficker scans for other machines to infect.^[26]

During CostaRicto, the threat actors employed nmap and pscan to scan target environments.^[27]

DarkVishnya performed port scanning to obtain the list of active services.^[28]

Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.^[29]

Empire can perform port scans from an infected host.^[30]

FIN13 has utilized nmap for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.^[31][32]

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.^[33]

Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.^[34][35]

As part of load balancing FRP can set healthCheck.type = "tcp" or healthCheck.type = "http" to check service status on specific hosts with TCPing or an HTTP request.^[36]

HDoor scans to identify open ports on the victim.^[37]

HermeticWizard has the ability to scan ports on a compromised network.^[38]

Hildegard has used masscan to look for kubelets in the internal Kubernetes network.^[39]

During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.^[40][41]

INC Ransom has used NETSCAN.EXE for internal reconnaissance.^[42][43]

Industroyer uses a custom port scanner to map out a network.^[44]

InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.^[45]

Koadic can scan for open TCP ports on the target network.^[46]

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.^[47]

Leafminer scanned network services to search for vulnerabilities in the victim system.^[48]

Lucifer can scan for open ports including TCP ports 135 and 1433.^[49]

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.^[50]

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.^[51]

MgBot includes modules for performing HTTP and server service scans.^[52]

MURKYTOP has the capability to scan for open ports on hosts in a connected network.^[19]

Naikon has used the LadonGo scanner to scan target networks.^[53]

NBTscan can be used to scan IP networks.^[54][55]

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.^[56]

During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.^[57]

P.A.S. Webshell can scan networks for open ports and listening services.^[58]

Peirates can initiate a port scan against a given IP address.^[59]

PoshC2 can perform port scans from an infected host.^[60]

Pupy has a built-in module for port scanning.^[61]

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.^[62]

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.^[63][64]

RedCurl has used netstat to check if port 4119 is open.^[65]

Remsec has a plugin that can perform ARP scanning as well as port scanning.^[66]

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.^[67][68]

Royal can scan the network interfaces of targeted systems.^[69]

SILENTTRINITY can scan for open ports on a compromised machine.^[70]

SpeakUp checks for availability of specific ports on servers.^[71]

Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.^[72]

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.^[73][39][74] TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.^[75]

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.^[76][77]

Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.^[78][79]

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.^[80]

Xbash can perform port scanning of TCP and UDP ports.^[81]

XTunnel is capable of probing the network for open ports.^[82]

ZxShell can launch port scans.^[8][83]

Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.

Use network intrusion detection/prevention systems to detect and prevent remote service scans.

Ensure proper network segmentation is followed to protect critical servers and devices.