MITRE ATT&CKtechnique

T0846 Remote System Discovery

Published 2020-05-21 Modified 2026-10-13 Official page ↗

Domain: ics
Tactics: Discovery
Platforms: Embedded, Windows, Linux, Network Devices
Version: 1.1
Created: 2020-05-21

Description

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities available on the operating system or vendor software could also be used.

Tactic · MITRE ATT&CK (1)

TA0102 Discovery tactic

Referenced by MITRE ATT&CK · mitigates (1)

M0814 Static Network Configuration mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

T0846.001 Port Scan sub-technique
T0846.002 Broadcast Discovery sub-technique
T0846.003 Multicast Discovery sub-technique

Referenced by MITRE ATT&CK · uses (5)

C0063 2025 Poland Wiper Attacks campaign
C0028 2015 Ukraine Electric Power Attack campaign
S1045 INCONTROLLER software (malware)
S0604 Industroyer software (malware)
S0093 Backdoor.Oldrea software (malware)

References

https://attack.mitre.org/wiki/Technique/T1018 Enterprise ATT&CK January 2018