{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1423","id":"T1423","name":"Network Service Scanning","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1423","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"fa8d7b24bab33f2c54574902669ac03140edc1bdcf947da380df5400f47f1072","description":"Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans from the mobile device. This technique may take advantage of the mobile device's access to an internal enterprise network either through local connectivity or through a Virtual Private Network (VPN).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1423","external_id":"T1423"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","parent":null,"children":[],"telemetry":[{"id":"proposed-lab-gateway-network-flows","name":"Lab gateway network flows","page":"telemetry/proposed-lab-gateway-network-flows/","kind":"proposed_input","category":"Network and protocol telemetry","description":"Flow observations at the mobile/OT lab gateway.","collection_focus":"Mirror the isolated lab egress and preserve device address leases/NAT mapping, byte counters and observation direction.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["gateway","device_ip","destination_ip","bytes_sent"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-lab-gateway-network-flows","collector":"illustrative-lab-collector","observation":{"gateway":"lab-gw-1","device_ip":"192.0.2.10","destination_ip":"198.51.100.20","bytes_sent":128}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"proposed_input","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"proposed-device-to-destination-connection-fan-out","name":"Device-to-destination connection fan-out","page":"telemetry/proposed-device-to-destination-connection-fan-out/","kind":"proposed_input","category":"Network and protocol telemetry","description":"Derived count of distinct destinations contacted by a device in a time window.","collection_focus":"Aggregate unsampled or explicitly characterized flow data over a fixed interval; keep NAT/device mapping and cardinality method.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["device_id","window_seconds","distinct_destinations","sampling"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-device-to-destination-connection-fan-out","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","window_seconds":60,"distinct_destinations":4,"sampling":"none"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"proposed_input","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"mobile/T1423","id":"T1423","name":"Network Service Scanning","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1423","technique_page":"techniques/mobile/T1423/","page":"detections/mobile/T1423/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0696","name":"Detection of Network Service Scanning","url":"https://attack.mitre.org/detectionstrategies/DET0696","stix_id":"x-mitre-detection-strategy--070d40c8-1aad-47e4-93d7-05e0362f437b","relationship_id":"relationship--1e9f9600-7ba3-44ae-b704-0fc0bd6e243b","description":"","analytics":[{"id":"AN1810","name":"Analytic 1810","guidance":"Network service scanning can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0696#AN1810","platforms":["Android"],"tuning":[],"log_sources":[]},{"id":"AN1811","name":"Analytic 1811","guidance":"Network service scanning can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0696#AN1811","platforms":["iOS"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-lab-gateway-network-flows","name":"Lab gateway network flows","tag":"Proposed: Lab gateway network flows","page":"telemetry/proposed-lab-gateway-network-flows/","kind":"proposed_input"},{"id":"proposed-device-to-destination-connection-fan-out","name":"Device-to-destination connection fan-out","tag":"Proposed: Device-to-destination connection fan-out","page":"telemetry/proposed-device-to-destination-connection-fan-out/","kind":"proposed_input"}],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) uses the `landevices` module to enumerate devices on the same WiFi network through active scanning.(Citation: Threatfabric LightSpy 2024)(Citation: LinkedIn Dmitry LightSpy 2025)(Citation: Shoshin_Kaspersky LightSpy 2020) ","relationship_id":"relationship--b336b44d-1810-4672-8e51-a63e91681907","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"},{"source_name":"Shoshin_Kaspersky LightSpy 2020","description":"Shoshin, P. (2020, March 27). LightSpy spyware targets iPhone users in Hong Kong. Retrieved February 12, 2025.","url":"https://usa.kaspersky.com/blog/lightspy-watering-hole-attack/21301/"},{"source_name":"Threatfabric LightSpy 2024","description":"ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios"}]}],"actors":[],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1423":"/ttp-simulation/techniques/mobile/T1423/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1423","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-lab-gateway-network-flows","collector":"illustrative-lab-collector","observation":{"gateway":"lab-gw-1","device_ip":"192.0.2.10","destination_ip":"198.51.100.20","bytes_sent":128}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-device-to-destination-connection-fan-out","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","window_seconds":60,"distinct_destinations":4,"sampling":"none"}}]}}