{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1046","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"03cc4c5aa28d7e4788d5e9b0acb039977edfeeaee54688de712650e685a76f88","description":"Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)   \n\nWithin cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.\n\nWithin macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as <code>dns-sd -B _ssh._tcp .</code>) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1046","external_id":"T1046"},{"source_name":"apple doco bonjour description","description":"Apple Inc. (2013, April 23). Bonjour Overview. Retrieved October 11, 2021.","url":"https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/NetServices/Introduction.html"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"},{"source_name":"macOS APT Activity Bradley","description":"Jaron Bradley. (2021, November 14). What does APT Activity Look Like on macOS?. Retrieved January 19, 2022.","url":"https://themittenmac.com/what-does-apt-activity-look-like-on-macos/"}],"platforms":["Containers","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","domain":"enterprise","platforms":["Containers","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T1046","technique_page":"techniques/enterprise/T1046/","page":"detections/enterprise/T1046/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"eae8c0c8-e5da-450a-9d7d-66aa56cd26b6","title":"OpenCanary - NMAP FIN Scan","status":"experimental","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/eae8c0c8-e5da-450a-9d7d-66aa56cd26b6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_portscan_nmap_fin_scan.yml","author":"Marco Pedrinazzi (@pedrinazziM)","kind":"sigma"},{"id":"68b8547b-107f-43f3-97fb-900a7d63c190","title":"OpenCanary - NMAP NULL Scan","status":"experimental","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/68b8547b-107f-43f3-97fb-900a7d63c190.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_portscan_nmap_null_scan.yml","author":"Marco Pedrinazzi (@pedrinazziM)","kind":"sigma"},{"id":"e8a677fd-248c-4eab-94df-de2f6f645884","title":"OpenCanary - NMAP OS Scan","status":"experimental","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/e8a677fd-248c-4eab-94df-de2f6f645884.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_portscan_nmap_os_scan.yml","author":"Marco Pedrinazzi (@pedrinazziM)","kind":"sigma"},{"id":"d7553d7b-f485-479c-b192-cdac6edd83a4","title":"OpenCanary - NMAP XMAS Scan","status":"experimental","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/d7553d7b-f485-479c-b192-cdac6edd83a4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_portscan_nmap_xmas_scan.yml","author":"Marco Pedrinazzi (@pedrinazziM)","kind":"sigma"},{"id":"974be8d2-283e-4033-ab08-7505b84204d0","title":"OpenCanary - Host Port Scan (SYN Scan)","status":"experimental","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/974be8d2-283e-4033-ab08-7505b84204d0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_portscan_syn_scan.yml","author":"Marco Pedrinazzi (@pedrinazziM)","kind":"sigma"},{"id":"3761e026-f259-44e6-8826-719ed8079408","title":"Linux Network Service Scanning - Auditd","status":"test","level":"low","logsource":{"product":"linux","service":"auditd","definition":"Configure these rules https://github.com/Neo23x0/auditd/blob/e181243a7c708e9d579557d6f80e0ed3d3483b89/audit.rules#L182-L183"},"data_path":"data/detection-rules/3761e026-f259-44e6-8826-719ed8079408.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_network_service_scanning.yml","author":"Alejandro Ortuno, oscd.community","kind":"sigma"},{"id":"97de11cd-4b67-4abf-9a8b-1020e670aa9e","title":"Pnscan Binary Data Transmission Activity","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/97de11cd-4b67-4abf-9a8b-1020e670aa9e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml","author":"David Burkett (@signalblur)","kind":"sigma"},{"id":"3e102cd9-a70d-4a7a-9508-403963092f31","title":"Linux Network Service Scanning Tools Execution","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/3e102cd9-a70d-4a7a-9508-403963092f31.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml","author":"Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])","kind":"sigma"},{"id":"84bae5d4-b518-4ae0-b331-6d4afd34d00f","title":"MacOS Network Service Scanning","status":"test","level":"low","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/84bae5d4-b518-4ae0-b331-6d4afd34d00f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_network_service_scanning.yml","author":"Alejandro Ortuno, oscd.community","kind":"sigma"},{"id":"fed85bf9-e075-4280-9159-fbe8a023d6fa","title":"Advanced IP Scanner - File Event","status":"test","level":"medium","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/fed85bf9-e075-4280-9159-fbe8a023d6fa.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml","author":"@ROxPinTeddy","kind":"sigma"},{"id":"bef0bc5a-b9ae-425d-85c6-7b2d705980c6","title":"Python Initiated Connection","status":"test","level":"medium","logsource":{"category":"network_connection","product":"windows","definition":"Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type"},"data_path":"data/detection-rules/bef0bc5a-b9ae-425d-85c6-7b2d705980c6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_python.yml","author":"frack113","kind":"sigma"},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","status":"test","level":"high","logsource":{"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/851fd622-b675-4d26-b803-14bc7baa517a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"98b53e78-ebaf-46f8-be06-421aafd176d9","title":"HackTool - winPEAS Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/98b53e78-ebaf-46f8-be06-421aafd176d9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml","author":"Georg Lauenstein (sure[secure])","kind":"sigma"},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d557dc06-62e8-4468-a8e8-7984124908ce.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"bef37fa2-f205-4a7b-b484-0759bfd5f86f","title":"PUA - Advanced IP Scanner Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bef37fa2-f205-4a7b-b484-0759bfd5f86f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml","author":"Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy","kind":"sigma"},{"id":"54773c5f-f1cc-4703-9126-2f797d96a69d","title":"PUA - Advanced Port Scanner Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/54773c5f-f1cc-4703-9126-2f797d96a69d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ca387a8e-1c84-4da3-9993-028b45342d30","title":"PUA - SoftPerfect Netscan Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ca387a8e-1c84-4da3-9993-028b45342d30.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_netscan.yml","author":"@d4ns4n_ (Wuerth-Phoenix)","kind":"sigma"},{"id":"4fd6b1c7-19b8-4488-97f6-00f0924991a3","title":"PUA - NimScan Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4fd6b1c7-19b8-4488-97f6-00f0924991a3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_nimscan.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"f6ecd1cf-19b8-4488-97f6-00f0924991a3","title":"PUA - Nmap/Zenmap Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f6ecd1cf-19b8-4488-97f6-00f0924991a3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1046-1","technique_id":"T1046","title":"T1046 Network Service Discovery","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#discovery","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":130,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L130","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"a7c689504584a9c9964c98600af2d76796fec9b23064a19ae19cb4ea0e69873f","validation":"published_concept_not_executable_or_live_validated","logic":"DISTINCT_COUNT(destination_port OR destination_host BY source_host, 5m) >= threshold -> ALERT","log_sources":[{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"Network Firewall Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#52-network-firewall-logs"},{"title":"Network Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#60-network-detection-and-response-telemetry"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1046-1","technique_id":"T1046","title":"Internal network services or systems scanned — T1046 Network Service Discovery","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#internal-service-scanning","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":89,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L89","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"a5eee04a19970c478f2d4b70f69a60d15cf1243846a8156c293d2502014aa412","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"internal source host.","expected_behavior":"hosts communicate with a stable peer and service set.","deviation":"rapid fan-out across destinations or ports and abrupt graph growth.","anomaly_types":[{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Graph-Evolution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#75-graph-evolution-anomaly"}],"log_sources":[{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"Network Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#60-network-detection-and-response-telemetry"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Fan-Out Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#78-fan-out-anomaly"},{"title":"Graph-Evolution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#75-graph-evolution-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"}],"strategies":[{"id":"DET0376","name":"Behavioral Detection Strategy for Network Service Discovery Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0376","stix_id":"x-mitre-detection-strategy--82e20b1f-300e-43cc-9259-1d506ef5d1f8","relationship_id":"relationship--56e3bbc8-0ff7-4877-836c-f081261d3a35","description":"","analytics":[{"id":"AN1057","name":"Analytic 1057","guidance":"Detects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1057","platforms":["Windows"],"tuning":[{"field":"ScanRateThreshold","description":"Defines the number of unique destination IPs or ports accessed within a time window that may indicate a scan."},{"field":"KnownScannerExeList","description":"List of binaries allowed to scan or used by IT (e.g., Nmap, Nessus)."},{"field":"TimeWindow","description":"Temporal bounds for correlating sequential connections (e.g., 60 seconds)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1057","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1057","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1057","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1057","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1058","name":"Analytic 1058","guidance":"Detects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1058","platforms":["Linux"],"tuning":[{"field":"PortScanThreshold","description":"Defines number of ports targeted per host within a short period."},{"field":"ToolPatternRegex","description":"Regex to match common scanner arguments (e.g., `nmap -sS`, `nc -zv`)."},{"field":"ExpectedScanSources","description":"Trusted IPs or systems performing routine discovery."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1058","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1058","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Outbound TCP SYN or UDP to multiple ports/hosts","platforms":["Linux"],"analytic_id":"AN1058","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1058","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN1059","name":"Analytic 1059","guidance":"Detects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1059","platforms":["macOS"],"tuning":[{"field":"MDNSServiceQueryPatterns","description":"mDNS queries such as _ssh._tcp.local that may indicate service discovery."},{"field":"UserContext","description":"Adjust alerting based on whether discovery activity originates from a background daemon vs. interactive session."},{"field":"ScanToolList","description":"Expected tools that could trigger mDNS or TCP/UDP scans (e.g., dns-sd, nmap)."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"dns-sd, mDNSResponder, socket activity","platforms":["macOS"],"analytic_id":"AN1059","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1059","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"process_events","platforms":["macOS"],"analytic_id":"AN1059","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1059","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1060","name":"Analytic 1060","guidance":"Detects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.","url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1060","platforms":["Containers"],"tuning":[{"field":"ExecutablePath","description":"Custom or renamed versions of tools may use different paths"},{"field":"TimeWindow","description":"Aggregation interval for identifying anomalous traffic"},{"field":"NetworkDestinationCount","description":"Tunable count of unique destinations to classify discovery"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"ebpf:syscalls","channel":"socket connect","platforms":["Containers"],"analytic_id":"AN1060","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1060","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0032","component":"Process Creation","name":"ebpf:syscalls","channel":"execve","platforms":["Containers"],"analytic_id":"AN1060","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1060","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"containerd:runtime","channel":"container-level outbound traffic events","platforms":["Containers"],"analytic_id":"AN1060","source_url":"https://attack.mitre.org/detectionstrategies/DET0376#AN1060","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"nmap","name":"Nmap","page":"tools/nmap/","kind":"curated_tool","bases":["atomic_test"],"guides":[{"id":"f36d74d1b2c0","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1","published_at":"2024-10-26","url":"https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0","archive_path":"docs/articles/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0.md","source_sha256":"976cadf83624ba0c723c03475eb784b4d8f24883134fbfeb8bc0fe070ab81965","tool_ids":["nmap"]},{"id":"d5a95569031c","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2","published_at":"2024-10-27","url":"https://1200km.com/articles/read/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c","archive_path":"docs/articles/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c.md","source_sha256":"51513cc49e2f90d50b0a3632c9f7aac3e2696ef7c885150873bd6fe195a1294d","tool_ids":["nmap"]},{"id":"450eec6e9db2","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 3","published_at":"2024-10-28","url":"https://1200km.com/articles/read/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2","archive_path":"docs/articles/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2.md","source_sha256":"2de93ed9c81f802a9121a97bcf8d3c022ea4481c04ef25d56a6a0ed5046edc1b","tool_ids":["nmap"]},{"id":"5ec77704057f","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts","published_at":"2024-10-30","url":"https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f","archive_path":"docs/articles/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f.md","source_sha256":"cec1a9e442358109fb5f3c66bfbe2c20096774176e7478a354e998e13df98756","tool_ids":["nmap"]},{"id":"e2acb6130be5","title":"Reinventing Recon: Nmap Meets ChatGPT","published_at":"2025-11-24","url":"https://1200km.com/articles/read/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5/","original_url":"https://medium.com/@1200km/reinventing-recon-nmap-meets-chatgpt-e2acb6130be5","archive_path":"docs/articles/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5.md","source_sha256":"6580ded0945cbd8a282299cf445cbaa6f8d43a2a81a4b57bf6c26fdd4cf088a7","tool_ids":["nmap"]}]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1144","name":"FRP","page":"tools/S1144/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"nmap","name":"Nmap","page":"tools/nmap/","kind":"curated_tool","bases":["atomic_test"],"guides":[{"id":"f36d74d1b2c0","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1","published_at":"2024-10-26","url":"https://1200km.com/articles/read/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0","archive_path":"docs/articles/2024/2024-10-26-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-1-f36d74d1b2c0.md","source_sha256":"976cadf83624ba0c723c03475eb784b4d8f24883134fbfeb8bc0fe070ab81965","tool_ids":["nmap"]},{"id":"d5a95569031c","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2","published_at":"2024-10-27","url":"https://1200km.com/articles/read/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c","archive_path":"docs/articles/2024/2024-10-27-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-2-d5a95569031c.md","source_sha256":"51513cc49e2f90d50b0a3632c9f7aac3e2696ef7c885150873bd6fe195a1294d","tool_ids":["nmap"]},{"id":"450eec6e9db2","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 3","published_at":"2024-10-28","url":"https://1200km.com/articles/read/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2","archive_path":"docs/articles/2024/2024-10-28-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-3-450eec6e9db2.md","source_sha256":"2de93ed9c81f802a9121a97bcf8d3c022ea4481c04ef25d56a6a0ed5046edc1b","tool_ids":["nmap"]},{"id":"5ec77704057f","title":"Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts","published_at":"2024-10-30","url":"https://1200km.com/articles/read/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f/","original_url":"https://medium.com/@1200km/mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f","archive_path":"docs/articles/2024/2024-10-30-mastering-nmap-a-comprehensive-guide-to-network-exploration-and-security-auditing-part-4-s-5ec77704057f.md","source_sha256":"cec1a9e442358109fb5f3c66bfbe2c20096774176e7478a354e998e13df98756","tool_ids":["nmap"]},{"id":"e2acb6130be5","title":"Reinventing Recon: Nmap Meets ChatGPT","published_at":"2025-11-24","url":"https://1200km.com/articles/read/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5/","original_url":"https://medium.com/@1200km/reinventing-recon-nmap-meets-chatgpt-e2acb6130be5","archive_path":"docs/articles/2025/2025-11-24-reinventing-recon-nmap-meets-chatgpt-e2acb6130be5.md","source_sha256":"6580ded0945cbd8a282299cf445cbaa6f8d43a2a81a4b57bf6c26fdd4cf088a7","tool_ids":["nmap"]}]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0020","name":"China Chopper","url":"https://attack.mitre.org/software/S0020","kind":"malware","description":"[China Chopper](https://attack.mitre.org/software/S0020)'s server component can spider authentication portals.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--73ce71e3-938e-4f5e-b588-32426e874577","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0061","name":"HDoor","url":"https://attack.mitre.org/software/S0061","kind":"malware","description":"[HDoor](https://attack.mitre.org/software/S0061) scans to identify open ports on the victim.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--db283fff-4b13-4c79-85f0-5cdb6b76e964","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) has conducted port scans on a host.(Citation: Securelist BlackEnergy Nov 2014)","relationship_id":"relationship--47e4d006-2685-4628-a46b-f6d9066f3585","references":[{"source_name":"Securelist BlackEnergy Nov 2014","description":"Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}]},{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) can use a network scanning module to identify ICS-related ports.(Citation: Gigamon Berserk Bear October 2021)","relationship_id":"relationship--129d828d-a84b-43dc-afc1-f46d8a25de0a","references":[{"source_name":"Gigamon Berserk Bear October 2021","description":"Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"id":"S0117","name":"XTunnel","url":"https://attack.mitre.org/software/S0117","kind":"malware","description":"[XTunnel](https://attack.mitre.org/software/S0117) is capable of probing the network for open ports.(Citation: Invincea XTunnel)","relationship_id":"relationship--a423dc5c-c506-4cc5-b65c-0c9269d18fb6","references":[{"source_name":"Invincea XTunnel","description":"Belcher, P.. (2016, July 28). Tunnel of Gov: DNC Hack and the Russian XTunnel. Retrieved August 3, 2016.","url":"https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-the-russian-xtunnel/"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) has a plugin that can perform ARP scanning as well as port scanning.(Citation: Kaspersky ProjectSauron Technical Analysis)","relationship_id":"relationship--e6b68811-113e-4f86-8096-9f506e34dda1","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can perform port scans from an infected host.(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--98e08749-5e7b-40ed-8a66-cd33f9c8c6ba","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0192","name":"Pupy","url":"https://attack.mitre.org/software/S0192","kind":"tool","description":"[Pupy](https://attack.mitre.org/software/S0192) has a built-in module for port scanning.(Citation: GitHub Pupy)","relationship_id":"relationship--01a1c2f4-ccb3-4238-9c9c-d6ca3a098ed9","references":[{"source_name":"GitHub Pupy","description":"Nicolas Verdier. (n.d.). Retrieved January 29, 2018.","url":"https://github.com/n1nj4sec/pupy"}]},{"id":"S0233","name":"MURKYTOP","url":"https://attack.mitre.org/software/S0233","kind":"malware","description":"[MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to scan for open ports on hosts in a connected network.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--db85ce33-98cf-4fec-93bd-402909cbe4bc","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0250","name":"Koadic","url":"https://attack.mitre.org/software/S0250","kind":"tool","description":"[Koadic](https://attack.mitre.org/software/S0250) can scan for open TCP ports on the target network.(Citation: Github Koadic)","relationship_id":"relationship--72f5ca9f-6b0e-4051-b2ae-da1b59e6ed2b","references":[{"source_name":"Github Koadic","description":"Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.","url":"https://github.com/offsecginger/koadic"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can scan the network for open ports and vulnerable instances of RDP and SMB protocols.(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--ddede021-d8bc-4303-9915-5b2dd0ebd4cd","references":[{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0341","name":"Xbash","url":"https://attack.mitre.org/software/S0341","kind":"malware","description":"[Xbash](https://attack.mitre.org/software/S0341) can perform port scanning of TCP and UDP ports.(Citation: Unit42 Xbash Sept 2018)","relationship_id":"relationship--9409dcff-0ddf-43f6-b7c0-937fd9216ee0","references":[{"source_name":"Unit42 Xbash Sept 2018","description":"Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can perform port scans from an infected host.(Citation: Github PowerShell Empire)","relationship_id":"relationship--2589342a-8f88-4458-bc34-cec6b073763e","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0374","name":"SpeakUp","url":"https://attack.mitre.org/software/S0374","kind":"malware","description":"[SpeakUp](https://attack.mitre.org/software/S0374) checks for availability of specific ports on servers.(Citation: CheckPoint SpeakUp Feb 2019)","relationship_id":"relationship--467f79d6-edf7-4e6a-a0d7-8196cd406ce1","references":[{"source_name":"CheckPoint SpeakUp Feb 2019","description":"Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.","url":"https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) can perform port scans from an infected host.(Citation: GitHub PoshC2)","relationship_id":"relationship--e45bff55-f8b0-406b-ba7d-03af2e7be8c8","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can launch port scans.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--704355c5-4743-4fe1-bd64-b7012fe7c1d2","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"},{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can scan for systems that are vulnerable to the EternalBlue exploit.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)\t","relationship_id":"relationship--2c9fad15-9b3f-45fe-854a-c87113d4695c","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","description":"Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.","url":"https://www.programmersought.com/article/62493896999/"}]},{"id":"S0532","name":"Lucifer","url":"https://attack.mitre.org/software/S0532","kind":"malware","description":"[Lucifer](https://attack.mitre.org/software/S0532) can scan for open ports including TCP ports 135 and 1433.(Citation: Unit 42 Lucifer June 2020)","relationship_id":"relationship--eacb7614-6cc9-4eb9-92fc-bba53ac4f59a","references":[{"source_name":"Unit 42 Lucifer June 2020","description":"Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) has a module to use a port scanner on a system.(Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--f46bb223-1276-4266-b653-d6b8c2943adf","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0583","name":"Pysa","url":"https://attack.mitre.org/software/S0583","kind":"malware","description":"[Pysa](https://attack.mitre.org/software/S0583) can perform network reconnaissance using the Advanced Port Scanner tool.(Citation: CERT-FR PYSA April 2020)","relationship_id":"relationship--fefae8e3-2549-4743-9713-7dfa40c52ae4","references":[{"source_name":"CERT-FR PYSA April 2020","description":"CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}]},{"id":"S0590","name":"NBTscan","url":"https://attack.mitre.org/software/S0590","kind":"tool","description":"[NBTscan](https://attack.mitre.org/software/S0590) can be used to scan IP networks.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)","relationship_id":"relationship--61de6721-267c-4224-8000-b3329f3057cf","references":[{"source_name":"Debian nbtscan Nov 2019","description":"Bezroutchko, A. (2019, November 19). NBTscan man page. Retrieved March 17, 2021.","url":"https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html"},{"source_name":"SecTools nbtscan June 2003","description":"SecTools. (2003, June 11). NBTscan. Retrieved March 17, 2021.","url":"https://sectools.org/tool/nbtscan/"}]},{"id":"S0598","name":"P.A.S. Webshell","url":"https://attack.mitre.org/software/S0598","kind":"malware","description":"[P.A.S. Webshell](https://attack.mitre.org/software/S0598) can scan networks for open ports and listening services.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--a0bb2dec-515f-4334-97c1-63fa6c9b4340","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has used masscan to look for kubelets in the internal Kubernetes network.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--4c1c2160-0b1d-4bb9-be29-e0c6e0570a2d","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) uses a custom port scanner to map out a network.(Citation: ESET Industroyer)","relationship_id":"relationship--1d1cc2e5-ef43-4b36-9077-3b173e03d254","references":[{"source_name":"ESET Industroyer","description":"Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S0608","name":"Conficker","url":"https://attack.mitre.org/software/S0608","kind":"malware","description":"[Conficker](https://attack.mitre.org/software/S0608) scans for other machines to infect.(Citation: SANS Conficker)","relationship_id":"relationship--cac01499-50ef-4cbf-a223-6879c139173a","references":[{"source_name":"SANS Conficker","description":"Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.","url":"https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm"}]},{"id":"S0683","name":"Peirates","url":"https://attack.mitre.org/software/S0683","kind":"tool","description":"[Peirates](https://attack.mitre.org/software/S0683) can initiate a port scan against a given IP address.(Citation: Peirates GitHub)","relationship_id":"relationship--679707b5-84d8-473d-9d28-e92a7d16763a","references":[{"source_name":"Peirates GitHub","description":"InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022.","url":"https://github.com/inguardians/peirates"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can scan for open ports on a compromised machine.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--87ebb077-671c-42b2-ad27-07f54b5920be","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0698","name":"HermeticWizard","url":"https://attack.mitre.org/software/S0698","kind":"malware","description":"[HermeticWizard](https://attack.mitre.org/software/S0698) has the ability to scan ports on a compromised network.(Citation: ESET Hermetic Wizard March 2022)","relationship_id":"relationship--a8aec030-1331-46d8-afa3-d08be70f55c0","references":[{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) can conduct port scanning against targeted systems.(Citation: Palo Alto Brute Ratel July 2022)","relationship_id":"relationship--9ee893d7-f87e-4d2e-a440-4ba9cb3a3561","references":[{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) can scan the network interfaces of targeted systems.(Citation: Cybereason Royal December 2022)","relationship_id":"relationship--455ad18f-00a1-4ac4-a77b-abb26a68996e","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can check for open ports on a computer by establishing a TCP connection.(Citation: BitDefender BADHATCH Mar 2021)","relationship_id":"relationship--6eaf57d7-1e0c-437a-b5e6-4b4dc6f00ae1","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1144","name":"FRP","url":"https://attack.mitre.org/software/S1144","kind":"tool","description":"As part of load balancing [FRP](https://attack.mitre.org/software/S1144) can set `healthCheck.type = \"tcp\"` or `healthCheck.type = \"http\"` to check service status on specific hosts with TCPing or an HTTP request.(Citation: FRP GitHub)","relationship_id":"relationship--8035ec83-a439-442f-81d9-9306d2235d91","references":[{"source_name":"FRP GitHub","description":"fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.","url":"https://github.com/fatedier/frp"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) includes modules for performing HTTP and server service scans.(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--c32ad752-3f38-4f34-b00d-c892d8698f0b","references":[{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) identifies remote systems via active directory queries for hostnames prior to launching remote ransomware payloads.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--8e330fc5-d4d9-4c6c-a73d-b8665d5fa547","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"To collect data on the host's Wi-Fi connection history, [LightSpy](https://attack.mitre.org/software/S1185) reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file`.It also utilizes Apple's CWWiFiClient API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.(Citation: Huntress LightSpy macOS 2024)","relationship_id":"relationship--c9c411dd-b313-4448-a2b9-17d00b3c78e2","references":[{"source_name":"Huntress LightSpy macOS 2024","description":"Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}]},{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) has enumerated the ports on victim systems within the victim environment.(Citation: AI-Mexico-Govt-Breach)","relationship_id":"relationship--1508970d-75b0-4a48-aba1-258439f4f349","references":[{"source_name":"AI-Mexico-Govt-Breach","description":"Eyal Sela. (2026, April). The AI-Assisted Breach of Mexico's Government Infrastructure. Retrieved September 2, 2026.","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}]}],"actors":[{"id":"G0019","name":"Naikon","url":"https://attack.mitre.org/groups/G0019","kind":"intrusion-set","description":"[Naikon](https://attack.mitre.org/groups/G0019) has used the LadonGo scanner to scan target networks.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--592a2355-077e-4692-a28a-da998ed5f937","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) actors use the Hunter tool to conduct network service discovery for vulnerable systems.(Citation: Dell TG-3390)(Citation: Unit42 Emissary Panda May 2019)","relationship_id":"relationship--13d8aec7-3e49-41f8-b57c-475cdc0d9632","references":[{"source_name":"Dell TG-3390","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"Unit42 Emissary Panda May 2019","description":"Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"id":"G0030","name":"Lotus Blossom","url":"https://attack.mitre.org/groups/G0030","kind":"intrusion-set","description":"[Lotus Blossom](https://attack.mitre.org/groups/G0030) has used port scanners to enumerate services on remote hosts.(Citation: Symantec Bilbug 2022)","relationship_id":"relationship--d4afacec-3b00-49b0-9c37-06f8a6c07526","references":[{"source_name":"Symantec Bilbug 2022","description":"Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.(Citation: Kaspersky ThreatNeedle Feb 2021)","relationship_id":"relationship--3faf013a-e1c4-494a-b2a1-6e9abef908b9","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","description":"Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"id":"G0037","name":"FIN6","url":"https://attack.mitre.org/groups/G0037","kind":"intrusion-set","description":"[FIN6](https://attack.mitre.org/groups/G0037) used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.(Citation: FireEye FIN6 April 2016)","relationship_id":"relationship--b1c49faa-0b6f-4a0e-85da-5ab8ddeab2ce","references":[{"source_name":"FireEye FIN6 April 2016","description":"FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"id":"G0039","name":"Suckfly","url":"https://attack.mitre.org/groups/G0039","kind":"intrusion-set","description":"[Suckfly](https://attack.mitre.org/groups/G0039) the victim's internal network for hosts with ports 8080, 5900, and 40 open.(Citation: Symantec Suckfly May 2016)","relationship_id":"relationship--9b360cf4-4600-4ea8-a28c-99d91e0d1734","references":[{"source_name":"Symantec Suckfly May 2016","description":"DiMaggio, J. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.","url":"http://www.symantec.com/connect/blogs/indian-organizations-targeted-suckfly-attacks"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has used tcping.exe, similar to [Ping](https://attack.mitre.org/software/S0097), to probe port status on systems of interest.(Citation: PWC Cloud Hopper Technical Annex April 2017)","relationship_id":"relationship--0d889b2d-eda4-45dc-99bf-c530b7d4b05f","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.(Citation: FireEye APT34 Webinar Dec 2017)","relationship_id":"relationship--393a3ec4-9970-44ab-ae63-1e9c6bed0310","references":[{"source_name":"FireEye APT34 Webinar Dec 2017","description":"Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--63994c7c-6544-4e29-9c94-ac2237166774","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--5d55b1c4-cdf4-4314-881e-ba0c853b1b60","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"id":"G0077","name":"Leafminer","url":"https://attack.mitre.org/groups/G0077","kind":"intrusion-set","description":"[Leafminer](https://attack.mitre.org/groups/G0077) scanned network services to search for vulnerabilities in the victim system.(Citation: Symantec Leafminer July 2018)","relationship_id":"relationship--4258ffdf-ecdb-465d-af16-bda97062ab7f","references":[{"source_name":"Symantec Leafminer July 2018","description":"Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"id":"G0080","name":"Cobalt Group","url":"https://attack.mitre.org/groups/G0080","kind":"intrusion-set","description":"[Cobalt Group](https://attack.mitre.org/groups/G0080) leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)","relationship_id":"relationship--edcd7a59-f8e0-41e5-b0f5-8d348fa13a10","references":[{"source_name":"PTSecurity Cobalt Group Aug 2017","description":"Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source_name":"PTSecurity Cobalt Dec 2016","description":"Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source_name":"Group IB Cobalt Aug 2017","description":"Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.","url":"https://www.group-ib.com/blog/cobalt"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) used <code>pr</code> and an openly available tool to scan for open ports on target systems.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--5929ef3e-3945-4ede-b3cd-94f47850a6bd","references":[{"source_name":"TrendMicro TropicTrooper 2015","description":"Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used [CrackMapExec](https://attack.mitre.org/software/S0488) and a custom port scanner known as BLUETORCH for network scanning.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)","relationship_id":"relationship--02caaeff-7429-444f-bac2-498fe3a73cfd","references":[{"source_name":"FireEye APT39 Jan 2019","description":"Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"BitDefender Chafer May 2020","description":"Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used a malware variant called WIDETONE to conduct port scans on specified subnets.(Citation: FireEye APT41 Aug 2019)","relationship_id":"relationship--883558d8-c445-45cf-a5cd-841fdf49f311","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G0098","name":"BlackTech","url":"https://attack.mitre.org/groups/G0098","kind":"intrusion-set","description":"[BlackTech](https://attack.mitre.org/groups/G0098) has used the SNScan tool to find other potential targets on victim networks.(Citation: Symantec Palmerworm Sep 2020)","relationship_id":"relationship--0bc4d3d8-8018-4e0a-a365-ebef543e1222","references":[{"source_name":"Symantec Palmerworm Sep 2020","description":"Threat Intelligence. (2020, September 29). Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors. Retrieved March 25, 2022.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt"}]},{"id":"G0105","name":"DarkVishnya","url":"https://attack.mitre.org/groups/G0105","kind":"intrusion-set","description":"[DarkVishnya](https://attack.mitre.org/groups/G0105) performed port scanning to obtain the list of active services.(Citation: Securelist DarkVishnya Dec 2018)","relationship_id":"relationship--3778dc3a-14b2-43e9-8e37-d1c3c731b390","references":[{"source_name":"Securelist DarkVishnya Dec 2018","description":"Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.","url":"https://securelist.com/darkvishnya/89169/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.(Citation: Talos Rocke August 2018)(Citation: Anomali Rocke March 2019)","relationship_id":"relationship--5d8e9a49-f534-4cb6-9e3e-aebacb3c1dd0","references":[{"source_name":"Talos Rocke August 2018","description":"Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source_name":"Anomali Rocke March 2019","description":"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used the <code>get -b <start ip> -e <end ip> -p</code> command for network scanning as well as a custom Python tool  packed into a Windows executable named Get.exe to scan IP ranges for HTTP.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--82c8372e-9b69-4720-a351-d6f0bda110d5","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has used tools including NMAP to conduct broad scanning to identify open ports.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)","relationship_id":"relationship--dd0c5079-1bd3-45fa-b8e7-aabf0a5513b7","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source_name":"ClearSky Pay2Kitten December 2020","description":"ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has leveraged [NBTscan](https://attack.mitre.org/software/S0590) to scan IP networks.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023)","relationship_id":"relationship--2773ed2b-4ec2-4528-8a3c-ca878fbbfa21","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"id":"G0135","name":"BackdoorDiplomacy","url":"https://attack.mitre.org/groups/G0135","kind":"intrusion-set","description":"[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--c92f6bab-4dfc-443d-903c-35318b80a396","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has used masscan to search for open Docker API ports and Kubernetes clusters.(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Cisco Talos Intelligence Group) [TeamTNT](https://attack.mitre.org/groups/G0139) has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.(Citation: Palo Alto Black-T October 2020)","relationship_id":"relationship--b84414c0-18e9-4483-83db-555bd2880740","references":[{"source_name":"Cado Security TeamTNT Worm August 2020","description":"Cado Security. (2020, August 16). Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021.","url":"https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"},{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"},{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source_name":"Palo Alto Black-T October 2020","description":"Quist, N. (2020, October 5). Black-T: New Cryptojacking Variant from TeamTNT. Retrieved September 22, 2021.","url":"https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) has used tools such as NMAP for remote system discovery and enumeration in victim environments.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--ff9369b6-62d2-46fd-acc9-ba20fdae8fac","references":[{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has utilized `nmap` for reconnaissance efforts. [FIN13](https://attack.mitre.org/groups/G1016) has also scanned for internal MS-SQL servers in a compromised network.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)","relationship_id":"relationship--2a37062f-9174-47b3-8c1f-2e32db19db1e","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","description":"Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--02279a7e-d5b8-44a7-99a3-64913b4ffa7b","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) used the open-source port scanner <code>WinEggDrop</code> to perform detailed scans of hosts of interest in victim networks.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--2996198c-97d1-48df-9463-6d1c0140f050","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) has used NETSCAN.EXE for internal reconnaissance.(Citation: SOCRadar INC Ransom January 2024)(Citation: SentinelOne INC Ransomware)","relationship_id":"relationship--6633ef0a-40ae-46f4-aff9-762fb4c0ab29","references":[{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","description":"SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has used netstat to check if port 4119 is open.(Citation: trendmicro_redcurl) ","relationship_id":"relationship--fa87affe-1703-48c9-adc7-14bf52d0cc14","references":[{"source_name":"trendmicro_redcurl","description":"Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) has used tools such as NetScan to enumerate network services in victim environments.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--0d79b40d-3ff5-42d6-a135-6e6555890a23","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has scanned open ports and services within the victim environment.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025) ","relationship_id":"relationship--14f063a6-0819-4549-b9e0-44ee9e0f2fc8","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has the capability to use living off the land (LOTL) binaries to perform network enumeration.(Citation: CISA Medusa Group Medusa Ransomware March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also utilized the publicly available scanning tool SoftPerfect Network Scanner (`netscan.exe`) to discover device hostnames and network services.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)","relationship_id":"relationship--ebf193e2-d75e-4204-80cd-a9791d7d3c18","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized PowerShell scripts to conduct ping and port scanning of victim subnets.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--ee291097-fca7-4a62-bf82-e05e6c6e49e9","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Ensure proper network segmentation is followed to protect critical servers and devices.","relationship_id":"relationship--80f94d40-0861-4403-b206-1c864a136788","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Use network intrusion detection/prevention systems to detect and prevent remote service scans.","relationship_id":"relationship--651225d6-5454-4c44-8d62-776bd7ddaed2","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.","relationship_id":"relationship--32d482c4-2c0d-4688-a38b-d73b5b2962a3","references":[]}],"candidates":[{"id":"05df2a79-dba6-4088-a804-9ca0802ca8e4","name":"Port-Scanning /24 Subnet with PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Scanning common ports in a /24 subnet. If no IP address for the target subnet is specified the test tries to determine the attacking machine's \"primary\" IPv4 address first and then scans that address with a /24 netmask.\nThe connection attempts to use a timeout parameter in milliseconds to speed up the scan. Please note the atomic might not print any output until the scans are completed.\n","inputs":{"ip_address":{"description":"IP-Address within the target subnet. Default is empty and script tries to determine local IP address of attacking machine. A comma separated list of targe IPs is also accepted (useful to simulate a wider scan while only scanning key host e.g., honeypots)","type":"string","default":""},"port_list":{"description":"Comma separated list of ports to scan","type":"string","default":"445, 3389"},"timeout_ms":{"description":"Connection timeout in milliseconds","type":"string","default":"200"}},"dependencies":[],"source_definition_sha256":"3fc53d89c4197acdd1efcefde43be2279cc04f72d6ce539720d92deef48ab17a"},{"id":"06eaafdb-8982-426e-8a31-d572da633caa","name":"Network Service Discovery for Containers","platforms":["containers"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.","inputs":{},"dependencies":[{"description":"Verify docker is installed."},{"description":"Verify docker service is running."}],"source_definition_sha256":"fdcec86001972138a958f5f6ac09a6fc1caf98ec73c967e7b72334168a1bc567"},{"id":"0d5a2b03-3a26-45e4-96ae-89485b4d1f97","name":"Port Scan using nmap (Port range)","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Scan multiple ports to check for listening ports with nmap\n","inputs":{"host":{"description":"Host(s) to scan.","type":"string","default":"127.0.0.1"},"port_range":{"description":"Port range(s) to scan.","type":"string","default":"0-65535"}},"dependencies":[{"description":"Check if nmap command exists on the machine\n"}],"source_definition_sha256":"8ac3a617f0fc7fe3518841c4d60d901f7a7977ce052ede74f00e03b5d13b4495"},{"id":"1cca5640-32a9-46e6-b8e0-fabbe2384a73","name":"WinPwn - bluekeep","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Search for bluekeep vulnerable Windows Systems in the domain using bluekeep function of WinPwn. Can take many minutes to complete (~600 seconds in testing on a small domain).","inputs":{},"dependencies":[],"source_definition_sha256":"5c03be1f4bf03ff96781edea5bbba6b344b19946907c782e604433eef09f521b"},{"id":"32c268dd-96a7-4530-817c-848534a39d09","name":"Windows - Port Scan using RustScan (Port list)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Scan ports on a target host using RustScan. Downloads the portable RustScan release binary and scans 127.0.0.1 by default. Uses --greppable so that nmap is not a dependency.\n","inputs":{"rustscan_url":{"description":"RustScan Windows release zip download URL","type":"url","default":"https://github.com/bee-san/RustScan/releases/download/2.4.1/x86_64-windows-rustscan.exe.zip"},"host_to_scan":{"description":"The host to scan with RustScan","type":"string","default":"127.0.0.1"},"port_list":{"description":"Comma-separated list of ports to scan (RustScan -p)","type":"string","default":"22,80,443,3389"},"rustscan_path":{"description":"Where the RustScan binary will be downloaded to or already is located","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\rustscan.exe"},"MVC_url":{"description":"Microsoft Visual C++ Redistributable download URL","type":"url","default":"https://aka.ms/vc14/vc_redist.x64.exe"},"MVC_path":{"description":"Where the Microsoft Visual C++ Redistributable installer will be downloaded to or already is located","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\vc_redist.x64.exe"}},"dependencies":[{"description":"RustScan must be available\n"},{"description":"Microsoft Visual C++ Redistributable must be installed (RustScan needs VCRUNTIME140.dll)\n"}],"source_definition_sha256":"60fb4ec9747203bd48a5a55115e37885ee9d6038a162a665edff87947e2cbc16"},{"id":"515942b0-a09f-4163-a7bb-22fefb6f185f","name":"Port Scan Nmap","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":3,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Scan ports to check for listening ports with Nmap.\nUpon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of addresses on port 80 to determine if listening. Results will be via stdout.\n","inputs":{"host":{"description":"Host to scan.","type":"string","default":"192.168.1.1"},"port":{"description":"Ports to scan.","type":"string","default":"80"},"network_range":{"description":"Network Range to Scan.","type":"string","default":"192.168.1.0/24"}},"dependencies":[{"description":"Check if nmap command exists on the machine\n"},{"description":"Check if nc command exists on the machine\n"},{"description":"Check if telnet command exists on the machine\n"}],"source_definition_sha256":"cbf3861ccc1541f4e238ef4df0c12196ff4ca386daf891f81e47a5f971ce4884"},{"id":"54574908-f1de-4356-9021-8053dd57439a","name":"WinPwn - spoolvulnscan","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Start MS-RPRN RPC Service Scan using spoolvulnscan function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"1c5f206033ca24c8e7458036afb9167d06316e2c085cc2a678db362aa85e99d8"},{"id":"68e907da-2539-48f6-9fc9-257a78c05540","name":"Port Scan","platforms":["linux","macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Scan ports to check for listening ports.\n\nUpon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.\n","inputs":{"host":{"description":"Host to scan.","type":"string","default":"192.168.1.1"}},"dependencies":[],"source_definition_sha256":"22b6ad5f66f9ee02eff8791db6deef81d0c449e40f37735c8d04abf72ce8f903"},{"id":"6ca45b04-9f15-4424-b9d3-84a217285a5c","name":"Port Scan using python","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Scan ports to check for listening ports with python\n","inputs":{"host_ip":{"description":"Host to scan.","type":"string","default":"127.0.0.1"},"filename":{"description":"Location of the project file","type":"path","default":"PathToAtomicsFolder\\T1046\\src\\T1046.py"}},"dependencies":[{"description":"Check if python exists on the machine\n"}],"source_definition_sha256":"8de9668cc03738f66940d4d96568b0a6f38f1ecc0bd7af0844347221637a228b"},{"id":"97585b04-5be2-40e9-8c31-82157b8af2d6","name":"WinPwn - MS17-10","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Search for MS17-10 vulnerable Windows Servers in the domain using powerSQL function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"57cb33ec5eb6a15bb263fa61f7ba78e7124f5c57de9ba4e701e64de182fd83ca"},{"id":"9e55750e-4cbf-4013-9627-e9a045b541bf","name":"Remote Desktop Services Discovery via PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Availability of remote desktop services can be checked using get- cmdlet of PowerShell\n","inputs":{},"dependencies":[],"source_definition_sha256":"2aecd6b672a9c2b22bc513026bb6ddec49cecbd7e1a7c4df408745a36a709e57"},{"id":"bb037826-cbe8-4a41-93ea-b94059d6bb98","name":"WinPwn - fruit","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Search for potentially vulnerable web apps (low hanging fruits) using fruit function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"6af7ed2d27a7b22f852b8d3b09486edcb763493de8a3d972c180e2c9172732b0"},{"id":"d696a3cb-d7a8-4976-8eb5-5af4abf2e3df","name":"Port Scan NMap for Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1046/T1046.yaml","description":"Scan ports to check for listening ports for the local host 127.0.0.1","inputs":{"nmap_url":{"description":"NMap installer download URL","type":"url","default":"https://nmap.org/dist/nmap-7.80-setup.exe"},"host_to_scan":{"description":"The host to scan with NMap","type":"string","default":"127.0.0.1"}},"dependencies":[{"description":"NMap must be installed\n"}],"source_definition_sha256":"4980affd8bddf27a15cbdc3ecc1d9c40ca2f6967616f9b1d0c5cc6efe9303114"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1046":"/ttp-simulation/techniques/enterprise/T1046/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1046","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}