T1046

Network Service Discovery

Discovery Last updated:

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods include port, vulnerability, and wordlist scans using tools such as nmap, masscan, zmap, CrackMapExec, and custom port scanners. Within cloud environments, adversaries may discover services on other cloud hosts or connected on-premises systems. On macOS, adversaries may leverage Bonjour/mDNSResponder to discover advertised services. Threat actors including Volt Typhoon, APT39, BlackTech, menuPass, FIN13, and ransomware operators like BlackByte routinely perform network service discovery as part of internal reconnaissance before lateral movement.

What is T1046 Network Service Discovery?

Network Service Discovery (T1046) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Network Service Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1046 Network Service Discovery
Canonical reference
https://attack.mitre.org/techniques/T1046/
Microsoft Sentinel / Defender
kusto 
let ScanningTools = dynamic([
  "nmap", "masscan", "zmap", "netscan", "portscan", "superscan",
  "angryip", "advanced_ip_scanner", "advanced ip scanner",
  "tcping", "winegddrop", "bluetorch", "snsscan", "nbtscan",
  "netdiscover", "unicornscan", "rustscan"
]);
let ScanningCLIPatterns = dynamic([
  "-sS", "-sT", "-sU", "-sV", "-sn", "-p ", "--top-ports",
  "-A ", "--script", "--open", "-Pn",
  "scan", "--rate", "--ports",
  "/scan", "/p:"
]);
let NativeScanPatterns = dynamic([
  "net view", "net use\\\\", "netstat -an", "netstat -a",
  "arp -a", "route print",
  "Test-NetConnection", "TNC ", "Test-Connection",
  "1..254", "1..65535",
  "New-Object Net.Sockets.TcpClient", "System.Net.Sockets"
]);
let ScanningProcesses = dynamic([
  "nmap.exe", "masscan.exe", "zmap.exe", "netscan.exe",
  "tcping.exe", "superscan.exe", "angryipscan.exe",
  "nbtscan.exe", "nbtscan-unixwiz.exe", "winegddrop.exe"
]);
// Branch 1: Known scanning tool execution
let KnownScanners = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (ScanningProcesses)
    or (ProcessCommandLine has_any (ScanningTools) and not ProcessCommandLine has_any ("update", "install", "help", "--version"))
| extend DetectionType = "KnownScanningTool"
| extend RiskIndicators = pack_array(
    iff(FileName has_any (ScanningProcesses), "KnownScannerBinary", ""),
    iff(ProcessCommandLine has "-sS" or ProcessCommandLine has "-sT", "SynOrTcpScan", ""),
    iff(ProcessCommandLine has "-sV" or ProcessCommandLine has "--script", "ServiceVersionProbe", ""),
    iff(ProcessCommandLine has "-p " or ProcessCommandLine has "--top-ports" or ProcessCommandLine has "--ports", "PortRangeSpecified", "")
  );
// Branch 2: Native tool / LOLBin scanning patterns
let NativeScanning = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
    and ProcessCommandLine has_any (NativeScanPatterns)
| extend DetectionType = "NativeToolScanning"
| extend RiskIndicators = pack_array(
    iff(ProcessCommandLine has "1..254" or ProcessCommandLine has "1..65535", "LoopPortOrHostScan", ""),
    iff(ProcessCommandLine has "Net.Sockets", "DotNetSocketScan", ""),
    iff(ProcessCommandLine has "Test-NetConnection" or ProcessCommandLine has "TNC ", "TestNetConnection", ""),
    iff(ProcessCommandLine has "netstat", "ServiceEnumeration", "")
  );
// Combine and enrich
KnownScanners
| union NativeScanning
| extend IsInteractiveUser = AccountName !in~ ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| extend InitiatingContext = strcat(InitiatingProcessFileName, " -> ", FileName)
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine, InitiatingProcessFileName,
         InitiatingProcessCommandLine, InitiatingContext,
         DetectionType, RiskIndicators, IsInteractiveUser
| sort by Timestamp desc

Detects network service discovery activity using two parallel branches: (1) execution of known port scanning binaries such as nmap, masscan, tcping, nbtscan, and NetScan; (2) native LOLBin scanning using PowerShell socket connections, Test-NetConnection loops, and netstat enumeration. Covers both external tooling brought onto the system and living-off-the-land techniques favored by threat actors like Volt Typhoon. Uses DeviceProcessEvents from Microsoft Defender for Endpoint.

medium severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Network engineers and IT administrators running nmap or AngryIP Scanner for authorized network inventory and asset discovery
  • Vulnerability management platforms (Nessus, Qualys, Rapid7 InsightVM agents) performing scheduled authenticated scans
  • Security operations teams running port scans during authorized penetration tests or purple team exercises
  • Monitoring tools using Test-NetConnection or netstat scripts to verify service availability and health checks
  • DevOps pipelines performing connectivity checks (Test-NetConnection, TCP client probes) during deployment validation

Sigma rule & cross-platform mapping

The detection logic for Network Service Discovery (T1046) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1046 Sigma rules on detection.fyi

Platform-specific guides for T1046

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-17 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1nmap SYN Scan Against Local Subnet

    Expected signal: Sysmon Event ID 1: Process Create with Image ending in nmap.exe, CommandLine containing '-sV -p' and '127.0.0.1'. Sysmon Event ID 3: Multiple network connection events from nmap.exe to 127.0.0.1 on specified ports. Sysmon Event ID 11: File created at %TEMP%\df00tech-nmap-test.txt. Security Event ID 4688 (if process command-line auditing enabled) showing nmap.exe process creation.

  2. Test 2PowerShell TCP Port Scan via .NET Socket Loop

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Net.Sockets.TcpClient' and 'Connect'. Sysmon Event ID 3: Multiple network connection events from powershell.exe to 127.0.0.1 on each tested port. PowerShell ScriptBlock Log Event ID 4104 capturing the full socket enumeration script.

  3. Test 3PowerShell Host Sweep with Test-NetConnection

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing '1..5', 'Test-NetConnection', and '-Port 80'. Sysmon Event ID 3: Multiple network connection attempts from powershell.exe to 127.0.0.1 through 127.0.0.5 on port 80. PowerShell ScriptBlock Log Event ID 4104 showing the full ForEach-Object loop.

  4. Test 4NBTScan NetBIOS Network Discovery

    Expected signal: Sysmon Event ID 1: Process Create with Image ending in nbtscan.exe and CommandLine containing a target IP range. Sysmon Event ID 3: UDP connection attempts from nbtscan.exe to target IP on port 137 (NetBIOS Name Service). Security Event ID 4688 with nbtscan.exe process creation if command-line auditing is enabled.

  5. Test 5Netstat Service Enumeration via CMD

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'netstat -ano' and 'findstr LISTENING'. Sysmon Event ID 11: File created at %TEMP%\df00tech-netstat.txt containing listening service output. Security Event ID 4688 for cmd.exe process if command-line auditing is enabled.

Response Playbook

Triage

  1. Identify the process and full command line — which scanning tool was used and what was the target scope (single host, subnet, full range)? Broad subnet scans (e.g., 10.0.0.0/8, 192.168.0.0/16) are more concerning than targeted single-host checks.
  2. Determine the user context — is this a dedicated scan host, a security engineer's workstation, or a standard endpoint where scanning tools are unexpected? Cross-reference with the asset inventory and user role.
  3. Check for a change ticket or authorized scan window — contact the network team or security operations to confirm whether a scan was scheduled. Verify against pentest engagement authorizations if applicable.
  4. Review the initiating process — what launched the scan? Office applications, browser processes, or script interpreters (wscript.exe, mshta.exe) spawning scanners is highly suspicious. Scheduled tasks or remote execution (PsExec, WMI) deserve elevated scrutiny.
  5. Examine scan targets — did the tool target internal subnets only, or include external IPs? Scanning of OT/ICS network segments, domain controllers, or privileged management subnets warrants immediate escalation.
  6. Check for temporal correlation — did this scanning activity follow other suspicious events such as a new process injection, credential access alert, or lateral movement indicator on the same host? Scanning that follows compromise is a strong post-exploitation indicator.
  7. Look for follow-on activity — did any lateral movement, exploitation attempts, or new connections to scanned hosts occur within 30 minutes of the scan completing?

Containment

  1. If scanning originated from an unexpected host with no authorized change ticket: isolate the endpoint from the network immediately using EDR network isolation or VLAN quarantine to prevent lateral movement to discovered services.
  2. If a compromised user account is suspected: disable the account in Active Directory, revoke Kerberos tickets (klist purge on affected host, reset password), and invalidate any OAuth/SSO sessions.
  3. If the scanner was dropped onto the system by malware: preserve the binary for forensic analysis before remediation, hash it, and submit to threat intelligence platforms. Block the hash via EDR and update AV signatures.
  4. Block outbound connections from the affected host to internal subnets not required for its business function using host-based firewall rules or network ACLs — this limits the usefulness of any discovered services.
  5. Notify the network team to review IDS/IPS alerts for the source IP — if the scanner generated scan traffic, network monitoring should have corresponding alerts that can help determine the full scope of discovered hosts.
  6. If scan results were written to disk (common with nmap XML/grepable output): recover and analyze the output files to understand exactly which services were mapped — this defines the attacker's target list.

Evidence Collection

  1. Process creation logs — Sysmon Event ID 1 or Security Event ID 4688 for the scanner process, including full command line, parent process, user context, and timestamp
  2. Scanner output files — nmap writes .xml, .gnmap, .nmap output files; masscan writes .json/.xml; NetScan writes .xml. Search for these on disk: C:\Users\*\AppData\Roaming\*, C:\Temp\*, C:\ProgramData\*
  3. Network connection logs — Sysmon Event ID 3 (Network Connection) for the scanner process showing destination IPs and ports; correlate with firewall/NAC logs to understand what was reachable
  4. File system artifacts — Prefetch file for the scanner binary (C:\Windows\Prefetch\NMAP*.pf, MASSCAN*.pf, NETSCAN*.pf) showing first and last execution timestamps and loaded modules
  5. DNS query logs — Sysmon Event ID 22 (DNS Query) for any reverse-lookup or hostname-resolution activity associated with the scan
  6. PowerShell ScriptBlock Logging (Event ID 4104) — if a PowerShell-based scanner was used, this captures the full script content including target ranges and port lists
  7. Scheduled task artifacts — HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks for persistence via scheduled scan tasks
  8. User's shell history — PowerShell ConsoleHost_history.txt, cmd doskey history, bash .bash_history — to determine if this was interactive or scripted activity

Escalation Criteria

  • ! Scan originated from a non-scan host (workstation, server) with no authorized change ticket — indicates potential post-compromise reconnaissance
  • ! Scanner binary was dropped and executed from a temp directory, user profile, or AppData path — strongly suggests attacker-delivered tooling rather than legitimate administrative use
  • ! Scan targets included domain controllers, Active Directory infrastructure, privileged management hosts, or OT/ICS network segments
  • ! Network service discovery immediately precedes lateral movement alerts or authentication attempts against discovered hosts
  • ! Multiple hosts on the same subnet exhibit scanning behavior within a short time window — suggests automated propagation or a worm-like component
  • ! The scanning process was spawned by a suspicious parent (Office application, browser, script engine) — indicates the scan is part of a post-exploitation chain following initial access
  • ! Scan output files contain evidence of discovered vulnerable services (e.g., SMB on port 445 across multiple hosts, RDP on 3389) combined with subsequent exploitation attempts

Investigation Guide

Forensic Artifacts

  • > File System: Scanner output files — nmap XML/grepable (*.xml, *.gnmap, *.nmap), masscan JSON (*.json), NetScan XML reports in user temp or working directory
  • > File System: C:\Windows\Prefetch\NMAP*.pf, MASSCAN*.pf, TCPING*.pf — execution timestamps, run count (up to 8 runs tracked), loaded DLLs
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — recent Run dialog executions including scanner launches
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths — evidence of scanner binary registration
  • > Event Log: Sysmon Event ID 3 (Network Connection) entries for the scanner process with destination IP ranges and ports
  • > Event Log: Sysmon Event ID 11 (File Create) for scanner output files written to disk
  • > Event Log: Sysmon Event ID 22 (DNS Query) for hostname resolution associated with scan targets
  • > Network: PCAP/NetFlow data showing TCP SYN sweep or UDP probe patterns to multiple ports/hosts in short timeframe — classic scan signature
  • > Shell History: PowerShell ConsoleHost_history.txt ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt) for interactive scan commands
  • > MFT (Master File Table): $MFT or $LogFile entries for recently created/deleted scanner binaries and output files — useful when files were deleted post-scan

Tuning Guidance

The primary tuning challenge for T1046 detection is distinguishing authorized network management and security scanning from post-compromise reconnaissance. Begin by building an allowlist of authorized scan hosts — typically dedicated vulnerability management servers (Nessus, Qualys, Rapid7) and jump hosts used by network engineers. Exclude these hosts by DeviceName from the KnownScanners branch. For the NativeScan branch, baseline legitimate Test-NetConnection usage in your environment — monitoring scripts checking service health are common. Build an exclusion list based on the initiating process (e.g., scheduled task names for known monitoring scripts) rather than by command-line pattern alone, as patterns can be spoofed. For the network-behavior hunting queries, tune the thresholds (UniqueHosts > 20, UniquePorts > 10) based on your environment's baseline — highly connected service accounts on dense networks may naturally exceed these. Consider narrowing the scan-type detection for non-scan hosts to a much lower threshold (e.g., UniqueHosts > 5 in 5 minutes from a standard workstation). Tag scan host exceptions in your CMDB and create a lookup table for automated suppression. Importantly, never suppress the detection entirely for unexpected process parents — a browser or Office document spawning nmap.exe has no legitimate explanation regardless of the user.

Hunting Queries

Hunt for host sweep or port scan patterns by analyzing network connection volume per process in 5-minute windows. Flags processes attempting connections to more than 20 unique hosts (host sweep) or more than 10 unique ports (port scan). Categorizes scan type to help distinguish broad reconnaissance (FullScan) from targeted service probing (PortScan) or ICMP-style ping sweeps (HostSweep). Catches scanners that don't match known binary names.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionAttempted" or ActionType == "ConnectionFailed"
| summarize
    PortsAttempted = dcount(RemotePort),
    UniqueHosts = dcount(RemoteIP),
    TotalAttempts = count(),
    PortList = make_set(RemotePort, 50),
    HostList = make_set(RemoteIP, 10)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 5m)
| where PortsAttempted > 10 or UniqueHosts > 20
| extend ScanType = case(
    UniqueHosts > 20 and PortsAttempted <= 5, "HostSweep",
    PortsAttempted > 10 and UniqueHosts <= 3, "PortScan",
    UniqueHosts > 10 and PortsAttempted > 5, "FullScan",
    1=1, "Unknown"
  )
| sort by TotalAttempts desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| bin _time span=5m
| stats
    dc(DestinationIp) as UniqueHosts,
    dc(DestinationPort) as UniquePorts,
    count as TotalConns,
    values(DestinationPort) as PortList
  by _time, host, Image, User
| where UniqueHosts > 20 OR UniquePorts > 10
| eval ScanType=case(
    UniqueHosts > 20 AND UniquePorts <= 5, "HostSweep",
    UniquePorts > 10 AND UniqueHosts <= 3, "PortScan",
    UniqueHosts > 10 AND UniquePorts > 5, "FullScan",
    1=1, "Unknown"
  )
| sort - TotalConns

Hunt for lateral spread of scanning tools — identifies accounts running known scanner binaries across multiple endpoints or with unusually high execution frequency. A single user running nmap on one authorized scan host is expected; the same user running it across 5+ endpoints is a strong compromise indicator. Useful for detecting worm-assisted tooling deployment or a threat actor moving laterally with their scanner.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("nmap.exe", "masscan.exe", "zmap.exe", "tcping.exe",
                       "netscan.exe", "superscan.exe", "nbtscan.exe",
                       "angryipscan.exe", "netdiscover", "rustscan")
| summarize
    ExecutionCount = count(),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp),
    Devices = make_set(DeviceName),
    DeviceCount = dcount(DeviceName),
    CommandLines = make_set(ProcessCommandLine, 20)
  by AccountName, FileName
| where DeviceCount > 1 or ExecutionCount > 5
| sort by DeviceCount desc, ExecutionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\nmap.exe" OR Image="*\\masscan.exe" OR Image="*\\zmap.exe" OR Image="*\\tcping.exe"
   OR Image="*\\netscan.exe" OR Image="*\\superscan.exe" OR Image="*\\nbtscan.exe")
| stats
    count as ExecCount,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen,
    dc(host) as DeviceCount,
    values(host) as Devices,
    values(CommandLine) as CommandLines
  by User, Image
| where DeviceCount > 1 OR ExecCount > 5
| sort - DeviceCount ExecCount

Hunt specifically for PowerShell-based port scanning without any known external binary — the 'living off the land' variant favored by nation-state actors like Volt Typhoon. Identifies for-loop IP/port enumeration (1..254), .NET TcpClient socket probing, and Test-NetConnection mass-checking patterns. These techniques generate no dropped binary artifacts and are invisible to file-based AV.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"1\.\.(254|255|65535)"
    or ProcessCommandLine has "System.Net.Sockets.TcpClient"
    or ProcessCommandLine has "Net.Sockets.Socket"
    or (ProcessCommandLine has "Test-NetConnection" and ProcessCommandLine matches regex @"\b(1[0-9]{1,2}|2[0-5]{2}|[1-9][0-9]?)\b.*\b(1[0-9]{1,2}|2[0-5]{2}|[1-9][0-9]?)\b")
| extend ScanMethod = case(
    ProcessCommandLine matches regex @"1\.\.(254|255|65535)", "ForLoopScan",
    ProcessCommandLine has "TcpClient", "DotNetTcpClientScan",
    ProcessCommandLine has "Net.Sockets.Socket", "RawSocketScan",
    1=1, "TestNetConnectionScan"
  )
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
         InitiatingProcessFileName, ScanMethod
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*1..254*" OR CommandLine="*1..255*" OR CommandLine="*1..65535*"
   OR CommandLine="*TcpClient*" OR CommandLine="*Net.Sockets*"
   OR CommandLine="*Test-NetConnection*")
| eval ScanMethod=case(
    match(CommandLine, "1\.\.(254|255|65535)"), "ForLoopScan",
    match(CommandLine, "TcpClient"), "DotNetTcpScan",
    match(CommandLine, "Net\.Sockets"), "RawSocketScan",
    match(CommandLine, "Test-NetConnection"), "TestNetConnectionScan",
    1=1, "Other"
  )
| table _time, host, User, CommandLine, ParentImage, ScanMethod
| sort - _time

Atomic Red Team Tests

Test 1 nmap SYN Scan Against Local Subnet
windows

Executes nmap with a TCP SYN scan against the local loopback range, simulating the most common network service discovery technique used by threat actors including APT39 and FIN13. The -sV flag enables service version detection, which is characteristic of adversary pre-exploitation reconnaissance. Safe to run as it targets localhost only.

Command

powershell 
nmap.exe -sV -p 22,80,443,445,3389,8080 127.0.0.1 -oN %TEMP%\df00tech-nmap-test.txt

Cleanup

powershell 
del /f %TEMP%\df00tech-nmap-test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image ending in nmap.exe, CommandLine containing '-sV -p' and '127.0.0.1'. Sysmon Event ID 3: Multiple network connection events from nmap.exe to 127.0.0.1 on specified ports. Sysmon Event ID 11: File created at %TEMP%\df00tech-nmap-test.txt. Security Event ID 4688 (if process command-line auditing enabled) showing nmap.exe process creation.

Expected Detection

KQL: KnownScanners branch triggers on FileName matching nmap.exe with PortRangeFlag=true and ServiceVersionProbe=true. SPL: KnownScanner=1, ServiceVersionProbe=1, SuspicionScore >= 2. Network hunting query identifies rapid multi-port connections from nmap.exe in the 5-minute window.

Test 2 PowerShell TCP Port Scan via .NET Socket Loop
windows

Performs a PowerShell-based port scan using .NET TcpClient socket connections in a for-loop against localhost. This living-off-the-land technique requires no external binaries and is used by threat actors including Volt Typhoon and in post-exploitation frameworks like Empire. Generates no file artifacts that antivirus can detect.

Command

powershell 
powershell.exe -NoProfile -Command "$ports = @(22,80,443,445,3389,8080,5985); foreach ($port in $ports) { try { $tcp = New-Object Net.Sockets.TcpClient; $tcp.Connect('127.0.0.1', $port); Write-Output "Port $port open"; $tcp.Close() } catch { Write-Output "Port $port closed" } }"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Net.Sockets.TcpClient' and 'Connect'. Sysmon Event ID 3: Multiple network connection events from powershell.exe to 127.0.0.1 on each tested port. PowerShell ScriptBlock Log Event ID 4104 capturing the full socket enumeration script.

Expected Detection

KQL: NativeScanning branch triggers on PowerShell with 'Net.Sockets' pattern. SPL: NativeScan=1, SuspicionScore >= 1. PowerShell socket hunting query matches TcpClient pattern with ScanMethod=DotNetTcpClientScan.

Test 3 PowerShell Host Sweep with Test-NetConnection
windows

Uses PowerShell Test-NetConnection (TNC) in a loop to sweep a range of loopback addresses checking for open HTTP port 80. This pattern — using a loop with TNC or ping — is a common living-off-the-land host discovery technique that requires only built-in Windows cmdlets. Used in post-exploitation scenarios to identify active hosts before targeted lateral movement.

Command

powershell 
powershell.exe -NoProfile -Command "1..5 | ForEach-Object { Test-NetConnection -ComputerName "127.0.0.$_" -Port 80 -InformationLevel Quiet -WarningAction SilentlyContinue }"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing '1..5', 'Test-NetConnection', and '-Port 80'. Sysmon Event ID 3: Multiple network connection attempts from powershell.exe to 127.0.0.1 through 127.0.0.5 on port 80. PowerShell ScriptBlock Log Event ID 4104 showing the full ForEach-Object loop.

Expected Detection

KQL: NativeScanning branch triggers on 'Test-NetConnection' and '1..' loop pattern. SPL: NativeScan=1 on Test-NetConnection match. PowerShell socket hunting query matches TestNetConnectionScan method. Network hunting query may flag rapid connection attempts from powershell.exe.

Test 4 NBTScan NetBIOS Network Discovery
windows

Executes nbtscan against localhost to discover NetBIOS-enabled systems — a technique used by Mustang Panda and other threat actors for rapid Windows host discovery on local subnets. NetBIOS scanning is lighter-weight than full TCP scanning and reveals Windows hostname and domain information without requiring elevated privileges.

Command

powershell 
nbtscan.exe 127.0.0.1/32

Expected Telemetry

Sysmon Event ID 1: Process Create with Image ending in nbtscan.exe and CommandLine containing a target IP range. Sysmon Event ID 3: UDP connection attempts from nbtscan.exe to target IP on port 137 (NetBIOS Name Service). Security Event ID 4688 with nbtscan.exe process creation if command-line auditing is enabled.

Expected Detection

KQL: KnownScanners branch triggers on FileName matching nbtscan.exe. SPL: KnownScanner=1, SuspicionScore >= 1. Scanner prevalence hunting query identifies nbtscan.exe execution with execution frequency and device spread analysis.

Test 5 Netstat Service Enumeration via CMD
windows

Uses the built-in netstat command to enumerate all listening services and established connections — a reconnaissance technique used by virtually every post-exploitation framework and threat actor when mapping available services before lateral movement. While netstat alone is low-signal, when combined with other discovery techniques or unusual parent processes it is a strong indicator.

Command

powershell 
cmd.exe /c netstat -ano | findstr LISTENING > %TEMP%\df00tech-netstat.txt && type %TEMP%\df00tech-netstat.txt

Cleanup

powershell 
del /f %TEMP%\df00tech-netstat.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'netstat -ano' and 'findstr LISTENING'. Sysmon Event ID 11: File created at %TEMP%\df00tech-netstat.txt containing listening service output. Security Event ID 4688 for cmd.exe process if command-line auditing is enabled.

Expected Detection

KQL: NativeScanning branch triggers on 'netstat' pattern in cmd.exe command line. SPL: NativeScan=1 on netstat pattern match, SuspicionScore >= 1. Context is elevated if parent process is unusual (Office, browser, script engine).

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1595.001Scanning IP BlocksT1595.002Vulnerability ScanningT1018Remote System DiscoveryT1049System Network Connections DiscoveryT1016System Network Configuration DiscoveryT1021.001Remote Desktop ProtocolT1021.002SMB/Windows Admin SharesT1021.006Windows Remote ManagementT1110.003Password SprayingT1190Exploit Public-Facing Application

Same Tactic: Discovery

Popular Detections