T1046 Google Chronicle · YARA-L

Detect Network Service Discovery in Google Chronicle

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods include port, vulnerability, and wordlist scans using tools such as nmap, masscan, zmap, CrackMapExec, and custom port scanners. Within cloud environments, adversaries may discover services on other cloud hosts or connected on-premises systems. On macOS, adversaries may leverage Bonjour/mDNSResponder to discover advertised services. Threat actors including Volt Typhoon, APT39, BlackTech, menuPass, FIN13, and ransomware operators like BlackByte routinely perform network service discovery as part of internal reconnaissance before lateral movement.

MITRE ATT&CK

Tactic
Discovery
Technique
T1046 Network Service Discovery
Canonical reference
https://attack.mitre.org/techniques/T1046/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1046_network_service_discovery {
  meta:
    author = "Detection Engineering — Argus Platform"
    description = "Detects network service discovery via known scanning tool execution or native LOLBin port-scan patterns consistent with internal reconnaissance before lateral movement"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1046"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1046/"
    severity = "HIGH"
    priority = "HIGH"
    created = "2026-04-17"
    confidence = "HIGH"
    threat_actors = "Volt Typhoon, APT39, BlackTech, menuPass, FIN13, BlackByte ransomware"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      /* Branch 1: Known scanning tool binary execution */
      re.regex(
        $e.target.process.file.full_path,
        `(?i)(nmap\.exe|masscan\.exe|zmap\.exe|netscan\.exe|tcping\.exe|superscan\.exe|angryipscan\.exe|nbtscan\.exe|nbtscan-unixwiz\.exe|winegddrop\.exe|rustscan|netdiscover|unicornscan)`
      )
      or
      /* Branch 2: Native LOLBin with scanning CLI patterns */
      (
        re.regex(
          $e.target.process.file.full_path,
          `(?i)(powershell\.exe|pwsh\.exe|cmd\.exe)`
        )
        and re.regex(
          $e.target.process.command_line,
          `(?i)(test-netconnection|tnc\s|[Nn]et\.Sockets\.TcpClient|System\.Net\.Sockets|1\.\.254|1\.\.65535|netstat\s+-a|arp\s+-a|net\s+view|net\s+use\\\\|route\s+print|new-object\s+net\.sockets)`
        )
      )
      or
      /* Branch 3: Scanning CLI flags in any process */
      (
        re.regex(
          $e.target.process.command_line,
          `(\s-sS\s|\s-sT\s|\s-sU\s|\s-sV\s|\s-sn\s|--top-ports|--script\s|--rate\s|\s-Pn\s|\s-p\s[0-9])`
        )
        and not re.regex(
          $e.target.process.command_line,
          `(?i)(--version|--help|install|update|man\s)`
        )
      )
    )

  condition:
    $e
}
high severity high confidence

YARA-L 2.0 rule detecting T1046 network service discovery via three detection branches: (1) direct execution of known scanning tool binaries, (2) native PowerShell or cmd.exe LOLBin patterns using TCP socket objects, Test-NetConnection, netstat, arp, or net view, and (3) explicit nmap-style scan flag arguments such as -sS, -sV, --top-ports, and --script present in any process command line. Suppresses obvious version/help invocations to reduce false positives.

Data Sources

Google Chronicle UDM via Bindplane/Chronicle Forwarder ingesting Windows Sysmon (Event ID 1)Chronicle Endpoint Detection and Response telemetryWindows Event Logs forwarded to Chronicle via Chronicle Forwarder or ingestion API

Required Tables

UDM Event type PROCESS_LAUNCHtarget.process.file.full_pathtarget.process.command_lineprincipal.hostname

False Positives & Tuning

  • Authorised red team or penetration testing engagements where nmap or masscan is executed from a designated attack host — these should be excluded by principal.hostname allowlist or time-window suppression tied to the engagement change record
  • Network monitoring daemons or SNMP discovery services that spawn short-lived processes with port-probe arguments as part of scheduled topology mapping
  • System administrators using PowerShell remoting health-check scripts that iterate IP ranges with Test-NetConnection to validate network segmentation rules after firewall changes
Download portable Sigma rule (.yml)

Other platforms for T1046

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1nmap SYN Scan Against Local Subnet

    Expected signal: Sysmon Event ID 1: Process Create with Image ending in nmap.exe, CommandLine containing '-sV -p' and '127.0.0.1'. Sysmon Event ID 3: Multiple network connection events from nmap.exe to 127.0.0.1 on specified ports. Sysmon Event ID 11: File created at %TEMP%\df00tech-nmap-test.txt. Security Event ID 4688 (if process command-line auditing enabled) showing nmap.exe process creation.

  2. Test 2PowerShell TCP Port Scan via .NET Socket Loop

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Net.Sockets.TcpClient' and 'Connect'. Sysmon Event ID 3: Multiple network connection events from powershell.exe to 127.0.0.1 on each tested port. PowerShell ScriptBlock Log Event ID 4104 capturing the full socket enumeration script.

  3. Test 3PowerShell Host Sweep with Test-NetConnection

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing '1..5', 'Test-NetConnection', and '-Port 80'. Sysmon Event ID 3: Multiple network connection attempts from powershell.exe to 127.0.0.1 through 127.0.0.5 on port 80. PowerShell ScriptBlock Log Event ID 4104 showing the full ForEach-Object loop.

  4. Test 4NBTScan NetBIOS Network Discovery

    Expected signal: Sysmon Event ID 1: Process Create with Image ending in nbtscan.exe and CommandLine containing a target IP range. Sysmon Event ID 3: UDP connection attempts from nbtscan.exe to target IP on port 137 (NetBIOS Name Service). Security Event ID 4688 with nbtscan.exe process creation if command-line auditing is enabled.

  5. Test 5Netstat Service Enumeration via CMD

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'netstat -ano' and 'findstr LISTENING'. Sysmon Event ID 11: File created at %TEMP%\df00tech-netstat.txt containing listening service output. Security Event ID 4688 for cmd.exe process if command-line auditing is enabled.

Last updated: 2026-04-17 Research depth: deep
References (12)

Unlock Pro Content

Get the full detection package for T1046 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1595.001Scanning IP BlocksT1595.002Vulnerability ScanningT1018Remote System DiscoveryT1049System Network Connections DiscoveryT1016System Network Configuration DiscoveryT1021.001Remote Desktop ProtocolT1021.002SMB/Windows Admin SharesT1021.006Windows Remote ManagementT1110.003Password SprayingT1190Exploit Public-Facing Application

Same Tactic: Discovery

Popular Detections