MITRE ATT&CKsub-technique

T0846.001 Port Scan

Published 2026-04-20 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Discovery
Platforms
Embedded, Windows, Linux, Network Devices
Version
1.0
Created
2026-04-20

Description

Adversaries may perform a port scan on a system, device, or network to identify live hosts, enumerate open ports and running services, identify operating systems, and map out the network. The results of a port scan may inform adversary Discovery, Lateral Movement, and vulnerability exploitation decisions (Exploitation for Evasion, Exploitation for Privilege Escalation, Exploitation of Remote Services). Some common tools for executing a port scan include `nmap`, `netcat`, and the Advanced Port Scanner.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T0846 Remote System Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M0930 Network Segmentation mitigation
  • M0931 Network Intrusion Prevention mitigation
  • M0814 Static Network Configuration mitigation

Referenced by MITRE ATT&CK · uses (5)

  • S9046 IOControl software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S1045 INCONTROLLER software (malware)
  • S0604 Industroyer software (malware)
  • S1006 PLC-Blaster software (malware)

References