Network Service Discovery

Network Service Discovery [T1046]

Information

• Name: Network Service Discovery

• ID: T1046

• Tactics: TA0007

Introduction

Network Service Discovery (MITRE ATT&CK ID: T1046) is a technique used by adversaries to enumerate services running on remote hosts within a targeted network environment. This technique is categorized under the "Discovery" tactic of the MITRE ATT&CK framework. Attackers leverage network service discovery to gain comprehensive knowledge about available services, open ports, and potentially vulnerable systems, facilitating further lateral movement, privilege escalation, or targeted exploitation.

Deep Dive Into Technique

Network Service Discovery involves identifying services actively listening on network ports across hosts within a target environment. Attackers typically use automated scanning tools and scripts to systematically probe network segments and hosts. Key technical details and execution methods include:

• Port Scanning Techniques:

  • TCP SYN scans (half-open scans): Rapidly identify open TCP ports without completing full TCP handshakes.

  • TCP Connect scans: Full TCP handshake scans, more detectable but reliable.

  • UDP scans: Identify services running on UDP ports, often slower due to protocol limitations.

  • FIN, NULL, XMAS scans: Stealth scans leveraging TCP flags to evade detection.

• Service Enumeration Techniques:

  • Banner Grabbing: Retrieve service banners to identify service versions and types.

  • Version Detection: Automated fingerprinting of services to identify exact software versions.

  • Vulnerability Scanners: Automated tools (e.g., Nessus, OpenVAS) to correlate services with known vulnerabilities.

• Common Tools and Utilities Used:

  • Nmap: Widely-used network scanning tool capable of various stealth and aggressive scanning techniques.

  • Masscan: High-speed port scanner optimized for large-scale network scanning.

  • Metasploit Framework: Includes modules for network discovery and enumeration.

  • Custom scripts leveraging Python, PowerShell, or Bash for targeted enumeration.

• Mechanisms and Protocols:

  • ICMP Echo Requests (Ping): Identify live hosts on the network.

  • ARP Scanning: Identify active hosts on local networks.

  • SNMP Enumeration: Gather detailed information about network devices.

  • SMB Enumeration: Identify shares, operating system details, and user information.

When this Technique is Usually Used

Attackers commonly employ Network Service Discovery at multiple stages of an attack lifecycle, including:

• Initial Reconnaissance:

  • Identifying potential entry points and vulnerable services before exploitation.

  • Mapping network topology and asset inventory.

• Lateral Movement:

  • Discovering additional hosts and services accessible from compromised systems.

  • Identifying internal services and resources for pivot points.

• Privilege Escalation and Persistence:

  • Enumerating services and versions to identify exploitable vulnerabilities.

  • Identifying misconfigured services that allow privilege escalation or persistent access.

• Pre-Exfiltration Stage:

  • Identifying network services that store sensitive data or facilitate data exfiltration.

  • Mapping internal network defenses and monitoring solutions.

How this Technique is Usually Detected

Detection of Network Service Discovery typically involves monitoring network traffic patterns, analyzing logs, and employing specialized security tools:

• Network Traffic Monitoring:

  • Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) detecting abnormal scanning patterns or excessive connection attempts.

  • Network flow analysis tools (e.g., NetFlow, Zeek/Bro, Suricata) identifying unusual traffic patterns indicative of scanning.

• Endpoint Detection and Response (EDR):

  • Monitoring for suspicious processes or scripts initiating network connections to multiple hosts or ports.

  • Identifying unauthorized scanning tools executed on endpoints.

• Log Analysis and SIEM Solutions:

  • Centralized log analysis (e.g., Splunk, ELK stack) to correlate events from firewalls, routers, and endpoint logs.

  • Alerting on repeated failed connection attempts or unusual protocols traversing network segments.

• Specific Indicators of Compromise (IoCs):

  • High volume of SYN packets without corresponding ACK packets.

  • Multiple failed connection attempts to sequential or random ports.

  • Repeated connection attempts originating from a single host to multiple destinations.

  • Presence of scanning tools such as Nmap, Masscan binaries or scripts on endpoints.

Why it is Important to Detect This Technique

Detecting Network Service Discovery is critical due to its role in enabling subsequent attack stages and its potential impact on network security posture:

• Early Warning of Potential Attacks:

  • Discovery activities often precede exploitation attempts; early detection provides proactive defense opportunities.

  • Allows security teams to investigate and respond before attackers escalate privileges or move laterally.

• Reducing Attack Surface:

  • Identifying unauthorized network scans helps security teams pinpoint exposed or misconfigured services.

  • Proactive remediation of vulnerabilities discovered through scans strengthens overall security posture.

• Preventing Lateral Movement:

  • Detection of internal network scanning can interrupt attackers' attempts to pivot across internal hosts.

  • Enables security teams to isolate compromised systems and limit attacker access.

• Minimizing Potential Damage:

  • Early detection and response limit attackers' ability to identify sensitive data repositories or exfiltration pathways.

  • Reduces potential data loss, intellectual property theft, and regulatory compliance violations.

Examples

Real-world examples demonstrating the use of Network Service Discovery include:

• APT Campaigns:

  • Advanced Persistent Threat (APT) groups frequently leverage Nmap scans to enumerate services before targeted exploitation.

  • Example: APT28 (Fancy Bear) used network scanning to identify vulnerable SMB services during initial reconnaissance stages.

• Ransomware Attacks:

  • Ransomware operators often utilize network scans to identify systems vulnerable to known exploits or weakly secured Remote Desktop Protocol (RDP) services.

  • Example: WannaCry ransomware leveraged SMB scanning to identify vulnerable Windows hosts susceptible to the EternalBlue exploit.

• Penetration Testing and Red Teaming:

  • Ethical penetration testers and red teams routinely perform network service discovery to identify potential attack vectors.

  • Example: Red teams commonly use tools like Nmap and Metasploit to enumerate services, identify vulnerabilities, and simulate realistic attack scenarios.

• Botnets and Automated Malware:

  • Botnet malware frequently incorporates automated scanning modules to discover vulnerable hosts and propagate infections.

  • Example: Mirai botnet conducted massive network scanning to identify IoT devices with default credentials or vulnerable services for recruitment into the botnet.

• Internal Threat Actors:

  • Malicious insiders may perform network scanning to identify sensitive internal resources or confidential data repositories.

  • Example: Insider threat scenarios involving employees leveraging internal scans to locate and exfiltrate proprietary information or trade secrets.