T0840 Network Connection Enumeration
ICSAdversaries may perform network connection enumeration to discover information about device communication patterns. If an adversary can inspect the state of a network connection with tools, such as Netstat, in conjunction with System Firmware, then they can determine the role of certain devices on the network. The adversary can also use Network Sniffing to watch network traffic for details about the source, destination, protocol, and content.
01
platforms
Platforms this applies to.
EmbeddedWindowsLinuxNetwork Devices
02
mitigations
ATT&CK mitigations that reduce this.
03
detected by (3)
Data components that detect this.
04
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
05
software (2)
Malware and tools associated with this.
06
targets assets (16)
ICS/OT assets this targets.
07
campaigns (1)
Campaigns that use this.
08
source
Where this definition is published.