MITRE ATT&CKsub-technique

T0846.003 Multicast Discovery

Published 2026-04-20 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Discovery
Platforms
Embedded, Windows, Linux, Network Devices
Version
1.0
Created
2026-04-20

Description

Adversaries may perform multicast discovery requests which is when one system or device sends messages to all systems and devices in a pre-defined group on a network (or subnet) and then waits for a response. If a response is received that means the system or device that responded is live and can communicate over that protocol. Multicast discovery tends to be stealthier than broadcast discovery because every system or device on the network (or subnet) is not being messaged. One common OT protocol that has a multicast discovery mechanism is the Process Field Network (PROFINET) Discovery and Configuration Protocol (DCP) with its Identify All requests.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T0846 Remote System Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M0930 Network Segmentation mitigation
  • M0814 Static Network Configuration mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S1045 INCONTROLLER software (malware)

References