Network Service Scanning
Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans using tools that are brought onto a system.
|APT32||APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities. |
|APT39||APT39 used a custom port scanner known as BLUETORCH |
|BlackEnergy||BlackEnergy has conducted port scans on a host. |
|China Chopper||China Chopper's server component can spider authentication portals. |
|Cobalt Group||Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.   |
|Cobalt Strike||Cobalt Strike can perform port scans from an infected host. |
|Empire||Empire can perform port scans from an infected host. |
|FIN6||FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS. |
|HDoor||HDoor scans to identify open ports on the victim. |
|Koadic||Koadic can scan for open TCP ports on the target network. |
|Leafminer||Leafminer scanned network services to search for vulnerabilities in the victim system. |
|menuPass||menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest. |
|MURKYTOP||MURKYTOP has the capability to scan for open ports on hosts in a connected network. |
|OilRig||OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning. |
|PoshC2||PoshC2 can perform port scans from an infected host. |
|Pupy||Pupy has a built-in module for port scanning. |
|Remsec||Remsec has a plugin that can perform ARP scanning as well as port scanning. |
|SpeakUp||SpeakUp checks for availability of specific ports on servers. |
|Suckfly||Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open. |
|Threat Group-3390||Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.  |
Tropic Trooper used
|Xbash||Xbash can perform port scanning of TCP and UDP ports. |
|XTunnel||XTunnel is capable of probing the network for open ports. |
|Disable or Remove Feature or Program||Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.|
|Network Intrusion Prevention||Use network intrusion detection/prevention systems to detect and prevent remote service scans.|
|Network Segmentation||Ensure proper network segmentation is followed to protect critical servers and devices.|
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Normal, benign system and network events from legitimate remote service scanning may be uncommon, depending on the environment and how they are used. Legitimate open port and vulnerability scanning may be conducted within the environment and will need to be deconflicted with any detection capabilities developed. Network intrusion detection systems can also be used to identify scanning activity. Monitor for process use of the networks and inspect intra-network flows to detect port scans.
- Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018.
- Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
- Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
- Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
- Nettitude. (2016, June 8). PoshC2: Powershell C2 Server and Implants. Retrieved April 23, 2019.
- Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
- Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
- Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
- Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.
- FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
- Belcher, P.. (2016, July 28). Tunnel of Gov: DNC Hack and the Russian XTunnel. Retrieved August 3, 2016.
- Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.
- Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
- Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.
- Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.
- Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
- DiMaggio, J.. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.
- Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.
- FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016.
- Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
- Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
- Falcone, R. and Lancaster, T.. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
- PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
- Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
- Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.