Network Service Discovery

What is Network Service Discovery?

“Network Service Discovery is documented as technique T1046 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Network Service Discovery activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for network scanning patterns including rapid sequential connection attempts to multiple hosts on common service ports, particularly from workstations or servers that have no administrative or security operations function.

2. 2

   Alert on execution of network scanning tools including nmap, masscan, and angry IP scanner, as well as PowerShell-based port scanners that may be used to evade detection by avoiding standalone executable files.

3. 3

   Detect ARP scanning and ICMP-based host discovery that precedes port scanning, as attackers typically perform host discovery before service enumeration to identify live hosts on network segments.

4. 4

   Monitor NetFlow data for internal hosts generating connection attempts to large numbers of destination IPs or ports within short time windows, which is the network-level signature of scanning activity.

5. 5

   Alert on connections to management interfaces on network infrastructure devices including SSH to routers and switches, SNMP queries from unauthorized sources, and telnet connections from workstations.

Example Alerts

These realistic alert examples show what Network Service Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Network Service Discovery?

Detection centers on SIEM, Firewall telemetry for the discovery phase of the attack. Monitor for network scanning patterns including rapid sequential connection attempts to multiple hosts on common service ports, particularly from workstations or servers that have no administrative or security operations function. Alert on execution of network scanning tools including nmap, masscan, and angry IP scanner, as well as PowerShell-based port scanners that may be used to evade detection by avoiding standalone executable files.

What does a Network Service Discovery alert look like?

A representative SIEM detection is "Internal Network Port Scan from Compromised Host" (high severity): NetFlow analysis detected workstation WS-MKT-033 initiating TCP SYN packets to 2,847 unique IP addresses on ports 22, 80, 443, 445, 3389, and 8080 over 12 minutes. This scanning rate and port selection pattern is characteristic of nmap service discovery. The source workstation has no network administration function and should not be generating this traffic volume.

Which tools detect Network Service Discovery, and how can I practice?

Network Service Discovery (T1046) is best surfaced with SIEM, Firewall telemetry, which exposes the discovery signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.