MITRE ATT&CKtechnique

T1046 Network Service Discovery

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Containers, IaaS, Linux, macOS, Network Devices, Windows
Version
3.2
Created
2017-05-31

Description

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system. Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1042 Disable or Remove Feature or Program mitigation
  • M1030 Network Segmentation mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (77)

  • G1059 NIMBUS MANTICORE group
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9045 BACKUPOSINT v9.0 APEX PREDATOR software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • G1051 Medusa Group group
  • G1045 Salt Typhoon group
  • S1185 LightSpy software (malware)
  • S1180 BlackByte Ransomware software (malware)
  • G1043 BlackByte group
  • G1039 RedCurl group
  • C0038 HomeLand Justice campaign
  • S1146 MgBot software (malware)
  • S1144 FRP software (tool)
  • G1032 INC Ransom group
  • G1030 Agrius group
  • S1081 BADHATCH software (malware)
  • G1016 FIN13 group
  • G1017 Volt Typhoon group
  • C0027 C0027 campaign
  • S1073 Royal software (malware)
  • S1063 Brute Ratel C4 software (tool)
  • C0018 C0018 campaign
  • C0014 Operation Wocao campaign
  • C0004 CostaRicto campaign
  • G1003 Ember Bear group
  • S0698 HermeticWizard software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0683 Peirates software (tool)
  • G0139 TeamTNT group
Show all 77 ›

Referenced by CAPEC · att&ck technique (1)

Referenced by Compliance · mitigates (15)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References