Network Service Scanning

Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system.

ID: T1046

Tactic: Discovery

Platform:  Linux, Windows, macOS

Permissions Required:  Administrator, SYSTEM, User

Data Sources:  Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process use of network

Version: 1.0

Mitigations

Mitigation Description
Disable or Remove Feature or Program Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.
Network Intrusion Prevention Use network intrusion detection/prevention systems to detect and prevent remote service scans.
Network Segmentation Ensure proper network segmentation is followed to protect critical servers and devices.

Examples

Name Description
APT32

APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.[1]

APT39

APT39 used a custom port scanner known as BLUETORCH[2]

BlackEnergy

BlackEnergy has conducted port scans on a host.[3]

China Chopper

China Chopper's server component can spider authentication portals.[4]

Cobalt Group

Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.[5][6][7]

Cobalt Strike

Cobalt Strike can perform port scans from an infected host.[8]

Empire

Empire can perform port scans from an infected host.[9]

FIN6

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.[10]

HDoor

HDoor scans to identify open ports on the victim.[11]

Koadic

Koadic can scan for open TCP ports on the target network.[12]

Leafminer

Leafminer scanned network services to search for vulnerabilities in the victim system.[13]

menuPass

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.[14]

MURKYTOP

MURKYTOP has the capability to scan for open ports on hosts in a connected network.[4]

OilRig

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.[15]

PoshC2

PoshC2 can perform port scans from an infected host.[16]

Pupy

Pupy has a built-in module for port scanning.[17]

Remsec

Remsec has a plugin that can perform ARP scanning as well as port scanning.[18]

SpeakUp

SpeakUp checks for availability of specific ports on servers.[19]

Suckfly

Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.[20]

Threat Group-3390

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.[21][22]

Tropic Trooper

Tropic Trooper used pr to scan for open ports on target systems.[23]

Xbash

Xbash can perform port scanning of TCP and UDP ports.[24]

XTunnel

XTunnel is capable of probing the network for open ports.[25]

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Normal, benign system and network events from legitimate remote service scanning may be uncommon, depending on the environment and how they are used. Legitimate open port and vulnerability scanning may be conducted within the environment and will need to be deconflicted with any detection capabilities developed. Network intrusion detection systems can also be used to identify scanning activity. Monitor for process use of the networks and inspect intra-network flows to detect port scans.

References