T1046: Network Service Discovery (Port Scanning)

Framework: MITRE ATT&CK · Tactic: Discovery · Total Cataloged Families: 23 · Observed Samples: 3,736 · Primary Threat Categories: Trojan · Ransomware · Rat

Operational Executive Summary

T1046 (Network Service Discovery (Port Scanning)) is classified under the Discovery tactic within the MITRE ATT&CK framework. Techniques adversaries employ to observe and orient themselves within an enterprise environment, profiling network shares, Active Directory domains, and local system configurations. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 23 distinct malware families, totaling over 3,736 validated samples.

Technical Anatomy & Adversary Tradecraft

Adversaries leverage Network Service Discovery (Port Scanning) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Network Service Discovery (Port Scanning), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.

In modern multi-stage campaigns, T1046 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Network Service Discovery (Port Scanning) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.

Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at https://attack.mitre.org/techniques/T1046/.

Detection Engineering & Threat Hunting

Detecting Network Service Discovery (Port Scanning) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:

Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.

SOC Containment & Hardening Guidance

To mitigate risks associated with T1046 (Network Service Discovery (Port Scanning)) across production infrastructure, security teams should implement the following defensive controls:

Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Network Service Discovery (Port Scanning) across adjacent network segments.

→ Incident Response Guidance: Read our Active Incident Response Playbook

Cataloged Malware Families Utilizing T1046 (23 Families)

The following malware families in the SystemHelpDesk catalog have been verified utilizing T1046 (Network Service Discovery (Port Scanning)):

23 families

Family	Category	Sample Count	Technical Summary
sdbot	Rat	`1,931`	SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer security history, first releas...
wabot	Rat	`1,185`	Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale zombie networks for co...
ircbot	Rat	`348`	Backdoor:Win32/Ircbot is a foundational lineage of remote access trojans and botnet agents that utilize Internet Relay Chat (IRC) protocol channels for decentra...
johnnie	Trojan	`221`	Johnnie (tracked in threat databases as Trojan:Win32/Johnnie, HackTool:Win32/Johnnie, and Worm:Win32/Johnnie) is a Windows trojan, reconnaissance hacktool, and ...
attack	Hacktool	`14`	Attack (classified across antimalware research as Trojan:Win32/Attack and HackTool:Win32/Attack) is a modular post-exploitation attack framework and lateral mov...
gatak	Ransomware	`5`	Trojan:Win32/Gatak (also tracked by Symantec as Trojan.Zbot/Gatak and sometimes functioning as ransomware) is a highly sophisticated malware family infamous for...
smbd	Advanced Threat	`5`	Worm:Win32/Smbd (or similar heuristic detections for SMB-exploiting worms) refers to a class of self-propagating malware that heavily relies on the Server Messa...
morto	Advanced Threat	`4`	Worm:Win32/Morto is a classic, highly aggressive network worm specifically designed to propagate across the internet and internal enterprise networks by attacki...
krepper	Trojan	`3`	Worm:Win32/Krepper is a highly virulent, self-replicating network worm designed to spread rapidly across vulnerable corporate environments. Unlike a trojan that...
vanbot	Trojan	`3`	Backdoor:Win32/Vanbot (derived from the Agobot/Spybot family) is a legacy trojan that infects a system and connects it to a clandestine Internet Relay Chat (IRC...
brambul	Worm	`2`	Worm:Win32/Brambul is an aggressive network-spreading worm developed by North Korean state-sponsored threat group HIDDEN COBRA (Lazarus Group / APT38). Discover...
darkmoon	Ransomware	`2`	Backdoor:Win32/Darkmoon (frequently associated with the commercial penetration testing framework Core Impact) is a highly sophisticated Remote Access Trojan (RA...
ircbrute	Trojan	`2`	Trojan:Win32/Ircbrute is a classification for a botnet agent or worm that combines the command-and-control (C2) infrastructure of an Internet Relay Chat (IRC) b...
ircfast	Trojan	`2`	Worm/Trojan:Win32/Ircfast is a network worm and botnet agent that leverages the Internet Relay Chat (IRC) protocol for command and control. Prevalent during the...
sqlcrack	Ransomware	`2`	HackTool:Win32/Sqlcrack is a detection for specialized offensive security tools and brute-force utilities designed to compromise backend databases, predominantl...
zombieboy	Ransomware	`2`	Trojan:Win32/Zombieboy is a highly aggressive, self-propagating cryptomining botnet (Worm) that emerged prominently around 2018. It is infamous for rapidly spre...
fspm	Ransomware	`1`	<h3>Executive Summary</h3> Fspm is a classification typically applied to a HackTool or localized exploit script designed to bypass security controls or facilita...
mirai	Botnet	`1`	Mirai (Japanese for 'the future') is a revolutionary Linux-based malware family and botnet that transformed internet of things (IoT) security upon its emergence...
taworm	Ransomware	`1`	Worm:Win32/Taworm is a self-replicating malware strain designed to spread rapidly across networks and removable media without requiring user interaction beyond ...
wirelessnetview	Trojan	`1`	HackTool:Win32/Wirelessnetview refers to the detection of a legitimate, dual-use network utility created by NirSoft. The tool is designed to monitor and display...
xscan	Advanced Threat	`1`	<h3>Executive Summary</h3> XScan is a powerful, legacy network vulnerability scanner and enumeration tool. Originally developed as a legitimate security auditin...
bump_rat	Trojan	`Sampled`	Bump-Rat is a specialized malware family that has drawn attention for its targeted application in cyber espionage campaigns. Unlike broadly distributed commodit...
lanfiltrator	Trojan	`Sampled`	LanFiltrator (cataloged across security software as Trojan:Win32/LanFiltrator, Spyware.Win32.LanFiltrator, and Trojan.LanFiltrator) is a specialized local area ...