T1046 Network Service Discovery
EnterpriseAdversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system. Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as <code>dns-sd -B _ssh._tcp.</code>) to find other systems broadcasting the ssh service.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
mitigations
ATT&CK mitigations that reduce this.
detected by (4)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringmoderate · backed by 5 of 11 mapped controls
- PR.DSData Securitymoderate · backed by 4 of 11 mapped controls
- PR.PSPlatform Securitymoderate · backed by 4 of 11 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (11)
Security controls that mitigate this.
known-exploited CVEs (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-32756US | critical9.8OT critical | KEV | ||
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMa… | ||||
| CVE-2025-0282US | critical9.0OT critical | KEV | ||
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.… | ||||
| CVE-2023-38035US | critical9.8OT critical | KEV | ||
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administra… | ||||
| CVE-2023-26360US | —OT critical | KEV | ||
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code… | ||||
| CVE-2021-21973US | medium5.3OT critical | KEV | ||
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with networ… | ||||
| CVE-2019-13608US | high7.5OT critical | KEV | ||
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. | ||||
| CVE-2019-11634US | critical9.8OT critical | KEV | ||
Citrix Workspace App before 1904 for Windows has Incorrect Access Control. | ||||
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (33)
Threat groups associated with this.
software (36)
Malware and tools associated with this.
campaigns (8)
Campaigns that use this.
Detected by (Sigma) (20)
Sigma detection rules related to this.
source
Where this definition is published.