Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.[1]
31 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has the capability to use living off the land (LOTL) binaries to perform network enumeration.1 Medusa Group has also utilized the publicly available scanning tool SoftPerfect Network Scanner (netscan.exe) to discover device hostnames and network services.2
Has used tools such as NetScan to enumerate network services in victim environments.1
Has used netstat to check if port 4119 is open.1
Used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.1
Has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.1
All 31 groups for this technique · 6 newest in this preview
7 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to enumerate internal network services and endpoints across targeted environments using browser automation via MCP, including databases, container registries, admin interfaces, and workflow orchestration platforms.1
During the 2025 Poland Wiper Attacks, the adversaries utilized Ping, the Advanced Port Scanner and Advanced IP Scanner to enumerate network devices.1
During C0027, used RustScan to scan for open ports on targeted ESXi appliances.1
During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.1
During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.12
During CostaRicto, the threat actors employed nmap and pscan to scan target environments.1
All 7 campaigns for this technique · 6 newest in this preview
35 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
To collect data on the host's Wi-Fi connection history, LightSpy reads the /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file.It also utilizes Apple's CWWiFiClient API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.1
Identifies remote systems via active directory queries for hostnames prior to launching remote ransomware payloads.1
Includes modules for performing HTTP and server service scans.1
As part of load balancing FRP can set healthCheck.type = "tcp" or healthCheck.type = "http" to check service status on specific hosts with TCPing or an HTTP request.1
Can check for open ports on a computer by establishing a TCP connection.1
Can scan the network interfaces of targeted systems.1
All 35 software entries for this technique · 6 newest in this preview
Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.
Technique Campaign use over its cumulative rule count.
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1057 · Windows
Detects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog: | EventCode= |
| Network Connection CreationDC0082 | WinEventLog: | EventCode= |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScanRateThreshold | Defines the number of unique destination IPs or ports accessed within a time window that may indicate a scan. |
| KnownScannerExeList | List of binaries allowed to scan or used by IT (e.g., Nmap, Nessus). |
| TimeWindow | Temporal bounds for correlating sequential connections (e.g., 60 seconds). |
AN1058 · Linux
Detects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd: | execve |
| Network Traffic FlowDC0078 | NSM: | Outbound TCP SYN or UDP to multiple ports/ |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PortScanThreshold | Defines number of ports targeted per host within a short period. |
| ToolPatternRegex | Regex to match common scanner arguments (e.g., nmap -sS, nc -zv). |
| ExpectedScanSources | Trusted IPs or systems performing routine discovery. |
AN1059 · macOS
Detects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos: | process_events |
| Network Traffic ContentDC0085 | macos: | dns-sd, mDNSResponder, socket activity |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MDNSServiceQueryPatterns | mDNS queries such as _ssh._tcp.local that may indicate service discovery. |
| UserContext | Adjust alerting based on whether discovery activity originates from a background daemon vs. interactive session. |
| ScanToolList | Expected tools that could trigger mDNS or TCP/UDP scans (e.g., dns-sd, nmap). |
AN1060 · Containers
Detects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | ebpf: | execve |
| Network Traffic FlowDC0078 | containerd: | container-level outbound traffic events |
| Network Connection CreationDC0082 | ebpf: | socket connect |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutablePath | Custom or renamed versions of tools may use different paths |
| TimeWindow | Aggregation interval for identifying anomalous traffic |
| NetworkDestinationCount | Tunable count of unique destinations to classify discovery |
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
After compromising an initial machine, adversaries commonly attempt to laterally move across the network. The first step to attempt the lateral movement often involves conducting host identification, port and service scans on the internal network via the compromised machine using tools such as Nmap, Cobalt Strike, etc.
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-CAA | Connection Attempt Analysis |
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| flow | start | dest_ip |
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
It should be noted that when a host/ port/ service scan is performed from a compromised machine, a single machine makes multiple calls to other hosts in the network to identify live hosts and services. This can be detected using the following query
sourcetype='firewall_logs' dest_ip = 'internal_subnet' | stats dc(dest_port) as pcount by src_ip | where pcount >5
Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.
Use network intrusion detection/prevention systems to detect and prevent remote service scans.
Ensure proper network segmentation is followed to protect critical servers and devices.
Tests from Atomic Red Team (MIT licence) · technique definition
33 rules are mapped to this technique.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Splunk | 2025-10-24 | 2026-05-13 | 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5 | |||
Detects the use of Advanced IP Scanner. (...) | Generic | test | file_event | windows | Sysmon | - | medium | @ROxPinTeddy | 2020-05-12 | 2022-11-29 | fed85bf9-e075-4280-9159-fbe8a023d6fa | ||||
Splunk | This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | efb20922-17bc-4fb0-880c-be50cfc100dd | |||
Splunk | The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 17e9b764-3a2b-4d36-9751-32d13ce4718b | |||
Splunk | The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 1f57f10e-1dc5-47ea-852c-2e85b2503d79 | |||
Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-11-26 | — | af688c76-4ce4-4309-bfdd-e896f01acf27 | ||||
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Georg Lauenstein (sure[secure]) | 2022-09-19 | 2023-03-23 | 98b53e78-ebaf-46f8-be06-421aafd176d9 | ||||
Detects commandline keywords indicative of potential usge of the tool WinPwn. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel | 2023-12-04 | — | d557dc06-62e8-4468-a8e8-7984124908ce | ||||
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...) | Generic | test | ps_script | windows | PowerShell | - | high | Swachchhanda Shrawan Poudel | 2023-12-04 | — | 851fd622-b675-4d26-b803-14bc7baa517a | ||||
Splunk | This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. (...) | Generic | stable | network_connection | - | AWS · Cisco Secure Firewall · Cisco | - | medium | Dean Luxton | 2024-07-01 | 2026-05-13 | 1ff9eb9a-7d72-4993-a55e-59a839e607f1 | - | ||
Splunk | This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using on of the NMAP top 20 ports. (...) | Generic | stable | network_connection | - | AWS · Cisco Secure Firewall · Cisco | - | medium | Dean Luxton | 2024-07-01 | 2026-09-08 | 3141a041-4f57-4277-9faa-9305ca1f8e5b | - | ||
Splunk | This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. (...) | Generic | stable | network_connection | - | AWS · Cisco Secure Firewall · Cisco | - | medium | Dean Luxton, Splunk | 2020-01-19 | 2026-05-13 | 40d2dc41-9bbf-421a-a34b-8611271a6770 | - | ||
Splunk | This analytic detects internal hosts triggering multiple IDS signatures, which may include either more than 25 signatures against a single host or a single signature across over 25 destination IP addresses. (...) | Generic | experimental | ids | - | - | - | medium | Dean Luxton | 2024-07-01 | 2026-05-13 | 46f946ed-1c78-4e96-9906-c7a4be15e39b | - | ||
Splunk | The following analytic detects potential scanning activities within a Kubernetes environment. (...) | Anomaly | stable | authentication | - | Kubernetes Audit · Kubernetes | - | medium | Patrick Bareiss, Splunk | 2023-12-20 | 2026-05-13 | 2f4abe6d-5991-464d-8216-f90f42999764 | |||
Splunk | The following analytic identifies potential scanning activities within a Kubernetes environment by unauthenticated IP addresses. (...) | Anomaly | stable | authentication | - | Kubernetes Audit · Kubernetes | - | medium | Patrick Bareiss, Splunk | 2023-12-20 | 2026-05-13 | f9cadf4e-df22-4f4e-a08f-9d3344c2165d | |||
Detects enumeration of local or remote network services. | Generic | test | process_creation | linux | Linux Auditd | - | low | Alejandro Ortuno, oscd.community | 2020-10-21 | 2023-09-26 | 3761e026-f259-44e6-8826-719ed8079408 | ||||
Detects execution of network scanning and reconnaisance tools. (...) | Generic | test | process_creation | linux | Sysmon | - | low | Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]) | 2020-10-21 | 2024-09-19 | 3e102cd9-a70d-4a7a-9508-403963092f31 | ||||
Detects enumeration of local or remote network services. | Generic | test | process_creation | macos | - | - | low | Alejandro Ortuno, oscd.community | 2020-10-21 | 2021-11-27 | 84bae5d4-b518-4ae0-b331-6d4afd34d00f | ||||
Detects many failed connection attempts to different ports or hosts | Unsupported | unsupported | firewall | - | - | - | medium | Thomas Patzke | 2017-02-19 | 2023-03-24 | 4601eaec-6b45-4052-ad32-2d96d26ce0d8 | - | |||
Detects many failed connection attempts to different ports or hosts | Unsupported | unsupported | firewall | - | - | - | medium | Thomas Patzke | 2017-02-19 | 2023-03-24 | fab0ddf0-b8a9-4d70-91ce-a20547209afb | - | |||
Detects instances where an OpenCanary node has been targeted by a SYN port scan. | Generic | experimental | - | - | OpenCanary | - | high | Marco Pedrinazzi (@pedrinazziM) | 2026-01-06 | — | 974be8d2-283e-4033-ab08-7505b84204d0 | ||||
Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan | Generic | experimental | - | - | OpenCanary | - | high | Marco Pedrinazzi (@pedrinazziM) | 2026-01-06 | — | eae8c0c8-e5da-450a-9d7d-66aa56cd26b6 | ||||
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan | Generic | experimental | - | - | OpenCanary | - | high | Marco Pedrinazzi (@pedrinazziM) | 2026-01-06 | — | 68b8547b-107f-43f3-97fb-900a7d63c190 | ||||
Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan | Generic | experimental | - | - | OpenCanary | - | high | Marco Pedrinazzi (@pedrinazziM) | 2026-01-06 | — | e8a677fd-248c-4eab-94df-de2f6f645884 | ||||
Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan | Generic | experimental | - | - | OpenCanary | - | high | Marco Pedrinazzi (@pedrinazziM) | 2026-01-06 | — | d7553d7b-f485-479c-b192-cdac6edd83a4 | ||||
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | David Burkett (@signalblur) | 2024-04-16 | — | 97de11cd-4b67-4abf-9a8b-1020e670aa9e | ||||
Detects the use of Advanced IP Scanner. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy | 2020-05-12 | 2023-02-07 | bef37fa2-f205-4a7b-b484-0759bfd5f86f | ||||
Detects the use of Advanced Port Scanner. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2021-12-18 | 2023-02-07 | 54773c5f-f1cc-4703-9126-2f797d96a69d | ||||
Detects usage of NimScan, a portscanner utility. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-02-05 | — | 4fd6b1c7-19b8-4488-97f6-00f0924991a3 | ||||
Detects usage of namp/zenmap. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-12-10 | 2023-12-11 | f6ecd1cf-19b8-4488-97f6-00f0924991a3 | ||||
Detects usage of SoftPerfect's "netscan.exe". (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | @d4ns4n_ (Wuerth-Phoenix) | 2024-04-25 | — | ca387a8e-1c84-4da3-9993-028b45342d30 | ||||
Detects a Python process initiating a network connection. (...) | Generic | test | network_connection | windows | Sysmon | - | medium | frack113 | 2021-12-10 | 2025-03-05 | bef0bc5a-b9ae-425d-85c6-7b2d705980c6 | ||||
Splunk | The following analytic identifies execution of Sysinternals PsTools and Sysinternals Suit binaries t (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali | 2025-10-24 | 2026-05-13 | 9a5f4b3e-1d2b-4c6f-9a8e-3b7d2f5c1a6e |