Network Service Discovery T1046
Tactic: Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.
Events covered
17 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 96 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (132 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (1018 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (144 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 24 rules
- Advanced IP Scanner - File Event
- Anonymous access performed to multiple targets
- Grixba Malware Reconnaissance Activity
- HackTool - winPEAS Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- Linux Network Service Scanning - Auditd
- Linux Network Service Scanning Tools Execution
- MacOS Network Service Scanning
- Network login performed to multiple targets
- OpenCanary - Host Port Scan (SYN Scan)
- OpenCanary - NMAP FIN Scan
- OpenCanary - NMAP NULL Scan
- OpenCanary - NMAP OS Scan
- OpenCanary - NMAP XMAS Scan
- Pnscan Binary Data Transmission Activity
- PUA - Advanced IP Scanner Execution
- PUA - Advanced Port Scanner Execution
- PUA - NimScan Execution
- PUA - Nmap/Zenmap Execution
- PUA - SoftPerfect Netscan Execution
- Python Initiated Connection
- RDP discovery performed on multiple hosts
- Suspicious anonymous login (domain specified)
Elastic 19 rules
- DNS Enumeration Detected via Defend for Containers
- Hping Process Activity
- Nping Process Activity
- Potential Linux Hack Tool Launched
- Potential Network Scan Detected
- Potential Network Scan Executed From Host
- Potential Network Sweep Detected
- Potential Port Scanning Activity from Compromised Host
- Potential PowerShell HackTool Script by Function Names
- Potential Subnet Scanning Activity from Compromised Host
- Potential SYN-Based Port Scan Detected
- Potentially Suspicious Process Started via tmux or screen
- Spike in Firewall Denies
- Spike in host-based traffic
- Spike in Network Traffic
- Spike in Network Traffic To a Country
- Suricata and Elastic Defend Network Correlation
- Suspicious Network Tool Launch Detected via Defend for Containers
- Suspicious Network Tool Launched Inside A Container
Splunk 23 rules
- Advanced IP or Port Scanner Execution
- Advanced IP Scanner Execution (Sysmon)
- Advanced IP Scanner Execution (Windows Event Log)
- Advanced Port Scanner Execution (Sysmon)
- Advanced Port Scanner Execution (Windows Event Log)
- Cisco IOS XE Remote Access Probe Burst
- Cisco Secure Firewall - Blocked Connection
- Cisco Secure Firewall - Repeated Blocked Connections
- FScan.exe Network Scan (Sysmon)
- FScan.exe Network Scan (Windows Event Log)
- Internal Horizontal Port Scan
- Internal Horizontal Port Scan NMAP Top 20
- Internal Port Scan - Critical Ports (Windows Event Log)
- Internal Vertical Port Scan
- Internal Vulnerability Scan
- Kubernetes Access Scanning
- Kubernetes Scanning by Unauthenticated IP Address
- masscan Execution - Windows (PowerShell)
- masscan Execution - Windows (Sysmon)
- masscan Execution - Windows (Windows Event Log)
- SoftPerfect Network Scanner Execution (Sysmon)
- SoftPerfect Network Scanner Execution (Windows Event Log)
- Windows PsTools Recon Usage
Kusto 24 rules
- A host is potentially running a hacking tool (ASIM Web Session schema)
- Abnormal Deny Rate for Source IP
- Anomaly found in Network Session Traffic (ASIM Network Session schema)
- App Gateway WAF - Scanner Detection
- AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports
- Cisco ASA - average attack detection rate increase
- Cisco ASA - threat detection message fired
- Cisco Cloud Security - Hack Tool User-Agent Detected
- CloudNGFW By Palo Alto Networks - possible internal to external port scanning
- CloudNGFW By Palo Alto Networks - Threat signatures from Unusual IP addresses
- Cross-Cloud Suspicious user activity observed in GCP Envourment
- GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports
- GSA - Detect Source IP Scanning Multiple Open Ports
- Netskope - Suspicious Network Context (Unusual IPs/Geo/Ports)
- Network Port Sweep from External Network (ASIM Network Session schema)
- Palo Alto - possible internal to external port scanning
- Palo Alto Threat signatures from Unusual IP addresses
- Port Scan
- Port Scan Detected
- Port scan detected (ASIM Network Session schema)
- Port Sweep
- Powershell Empire Cmdlets Executed in Command Line
- Rare client observed with high reverse DNS lookup count
- Several deny actions registered