T1046 Network Service Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. MITRE ATT&CK

11 Sigma rules T1046 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

highGrixba Malware Reconnaissance Activityyxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highHackTool - winPEAS ExecutionGeorg Lauenstein (sure[secure]) · Windows

highHackTool - WinPwn ExecutionSwachchhanda Shrawan Poudel · Windows

mediumPnscan Binary Data Transmission ActivityDavid Burkett (@signalblur) · Linux

mediumPUA - Advanced IP Scanner ExecutionNasreddine Bencherchali (Nextron Systems), @ROxPinTeddy · Windows

mediumPUA - Advanced Port Scanner ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

mediumPUA - NimScan ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPUA - Nmap/Zenmap Executionfrack113 · Windows

mediumPUA - SoftPerfect Netscan Execution@d4ns4n_ (Wuerth-Phoenix) · Windows

lowLinux Network Service Scanning Tools ExecutionAlejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]) · Linux

lowMacOS Network Service ScanningAlejandro Ortuno, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Ping a destination with 4 ICMP ping requests on the page for hping3

hping3 --icmp --count 4 ip_or_hostnameIdentify

Ping an IP address over UDP on port 80 on the page for hping3

hping3 --udp --destport 80 --syn ip_or_hostnameIdentify

Scan TCP port 80, scanning from the specific local source port 5090 on the page for hping3

hping3 --verbose --syn --destport 80 --baseport 5090 ip_or_hostnameIdentify

Connect to a target listener on the specified port and receive a file from it on the page for nc

nc host port >received_filenameIdentify

Scan the open TCP ports of a specified host on the page for nc

nc -v -z -w timeout_in_seconds host start_port-end_portIdentify

Scan the top 1000 ports of a remote host with various verbosity levels on the page for nmap

nmap -v1 ip_or_hostnameIdentify

Run a ping sweep over an entire subnet or individual hosts very aggressively on the page for nmap

nmap -T5 -sn 192.168.0.0/24Identify

Enable OS detection, version detection, script scanning, and traceroute of hosts from a file on the page for nmap

sudo nmap -A -iL path/to/file.txtIdentify

Listen to a port, wait for an incoming connection, and transfer data to STDIO on the page for socat

sudo socat - TCP-LISTEN:8080,forkIdentify

Listen on a port using SSL and print to stdout on the page for socat

sudo socat OPENSSL-LISTEN:4433,reuseaddr,cert=./cert.pem,cafile=./ca.cert.pem,key=./key.pem,verify=0 STDOUTIdentify

Create a connection to a host and port, transfer data in STDIO to connected host on the page for socat

sudo socat - TCP4:www.example.com:80Identify

Telnet to the default port of a host on the page for telnet

telnet hostIdentify

And 13 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1046: a Sigma rule it trips is tagged with it, or its abuse is documented as it.