Network Service Discovery

ID: T1046
Tactics: TA0007 Discovery
Platforms: Containers, IaaS, Linux, macOS, Network Devices, Windows
Data sources: Process Creation, Network Connection Creation, Network Traffic Flow, Network Traffic Content
Source: attack.mitre.org
MITRE last modified: 12 May 2026

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.^[1]

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.

Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.^[2]^[3]

Detection

DET0376 Behavioral Detection Strategy for Network Service Discovery Across Platforms
Data components: Process Creation, Network Connection Creation, Network Traffic Flow, Network Traffic Content

Mitigations (3)

M1030 Network Segmentation: Ensure proper network segmentation is followed to protect critical servers and devices.
M1031 Network Intrusion Prevention: Use network intrusion detection/prevention systems to detect and prevent remote service scans.
M1042 Disable or Remove Feature or Program: Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.

Network Service Discovery

Detection

Mitigations (3)

Groups (33)

Software (36)

References