T1046 — Network Service Discovery

Tactic: Discovery · Platforms: Containers, IaaS, Linux, macOS, Network Devices, Windows

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools…

Sigma detection rules (4)

T1046 Network Service Discovery

title: T1046 Network Service Discovery
id: b85f676b-95b0-4a0f-8938-4378b3d94d22
description: 'Behavioral Detection Strategy for Network Service Discovery Across Platforms. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: ScanRateThreshold, KnownScannerExeList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1046
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.discovery
  - attack.t1046

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\nmap.exe'
      - '\masscan.exe'
      - '\advanced_port_scanner.exe'

  selection_ps:
    CommandLine|contains|all:
      - 'Test-NetConnection'
      - 'InformationLevel'

  condition: 1 of selection*

falsepositives:
  - Authorized vulnerability-scanning or network-inventory tools run by IT/security teams — allowlist known scanner source hosts.

level: high

T1046 Network Service Discovery

title: T1046 Network Service Discovery
id: d04419a6-98a6-47bb-95f1-51c5f139ddd0
description: 'Behavioral Detection Strategy for Network Service Discovery Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PortScanThreshold, ToolPatternRegex, ExpectedScanSources.'
references:
  - https://attack.mitre.org/techniques/T1046
author: Shahrukh Khan
date: 2026-05-12
license: MIT
tags:
  - attack.discovery
  - attack.t1046

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/nmap'
      - '/masscan'
      - '/zmap'
  condition: selection

falsepositives:
  - Authorized vulnerability scanning or network inventory activity by IT/security teams using the same tools.

level: medium

T1046 Network Service Discovery

title: T1046 Network Service Discovery
id: 871a690c-bab7-4942-8e0c-7b1811c5c0be
description: 'Behavioral Detection Strategy for Network Service Discovery Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MDNSServiceQueryPatterns, UserContext, ScanToolList.'
references:
  - https://attack.mitre.org/techniques/T1046
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.discovery
  - attack.t1046

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/nmap'
  selection_mdns:
    Image|endswith: '/dns-sd'
    CommandLine|contains: '-B'
  condition: 1 of selection*

falsepositives:
  - Legitimate network inventory or asset-discovery scans run by IT or security teams.

level: low

T1046 Network Service Discovery

title: T1046 Network Service Discovery
id: bf17bba1-440d-4c02-8fa0-587e843cf804
description: 'Behavioral Detection Strategy for Network Service Discovery Across Platforms. (Data Component: Network Connection Creation; baseline tier: fallback.) Tune using: ExecutablePath, TimeWindow, NetworkDestinationCount.'
references:
  - https://attack.mitre.org/techniques/T1046
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.discovery
  - attack.t1046

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_nmap:
    type: EXECVE
    a0|endswith: '/nmap'
  selection_masscan:
    type: EXECVE
    a0|endswith: '/masscan'

  condition: selection_nmap or selection_masscan

falsepositives:
  - Authorized vulnerability scanning tools and network administrators auditing their own subnets with nmap or masscan.

level: medium

Explore