T1046 Sumo Logic CSE · Sumo

Detect Network Service Discovery in Sumo Logic CSE

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods include port, vulnerability, and wordlist scans using tools such as nmap, masscan, zmap, CrackMapExec, and custom port scanners. Within cloud environments, adversaries may discover services on other cloud hosts or connected on-premises systems. On macOS, adversaries may leverage Bonjour/mDNSResponder to discover advertised services. Threat actors including Volt Typhoon, APT39, BlackTech, menuPass, FIN13, and ransomware operators like BlackByte routinely perform network service discovery as part of internal reconnaissance before lateral movement.

MITRE ATT&CK

Tactic
Discovery
Technique
T1046 Network Service Discovery
Canonical reference
https://attack.mitre.org/techniques/T1046/

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
(_sourceCategory=*Windows/Sysmon* OR _sourceCategory=*WinEventLog/Security* OR _sourceCategory=*windows/security*)
| where EventID in ("1", "4688")
| parse field=CommandLine "*" as cmdline nodrop
| parse field=Image "*" as image_path nodrop
| parse field=NewProcessName "*" as image_path2 nodrop
| eval image_path = if(isNull(image_path), image_path2, image_path)
| eval cmdline_lower = toLowerCase(cmdline)
| eval image_lower = toLowerCase(image_path)
/* Flag known scanning tool binaries */
| eval known_scanner = if(
    matches(image_lower, ".*(nmap\.exe|masscan\.exe|zmap\.exe|netscan\.exe|tcping\.exe|superscan\.exe|nbtscan\.exe|angryipscan\.exe|winegddrop\.exe|rustscan|netdiscover|unicornscan).*"),
    1, 0
  )
/* Flag native LOLBin scanning in PowerShell/cmd */
| eval native_scan = if(
    matches(image_lower, ".*(powershell\.exe|pwsh\.exe|cmd\.exe).*")
    AND matches(cmdline_lower, ".*(test-netconnection|tnc\s|net\.sockets|1\.\.254|1\.\.65535|netstat\s+-a|arp\s+-a|net\s+view|net\s+use\\\\|route\s+print).*"),
    1, 0
  )
/* Flag port range or scan-flag arguments */
| eval port_range = if(
    matches(cmdline_lower, ".*(-p\s+|--top-ports|--ports|/p:|--rate).*"),
    1, 0
  )
/* Flag service version or aggressive scan flags */
| eval service_version = if(
    matches(cmdline_lower, ".*(-sv|-ss|-st|-su|-sn|--script|--open|-pn).*"),
    1, 0
  )
| eval suspicion_score = known_scanner + native_scan + port_range + service_version
| where suspicion_score > 0
| eval detection_type = if(known_scanner = 1, "KnownScanningTool",
    if(native_scan = 1, "NativeToolScanning", "PortScanPattern")
  )
| eval user = if(isNull(User), SubjectUserName, User)
| eval parent_image = if(isNull(ParentImage), ParentProcessName, ParentImage)
/* Exclude machine accounts */
| where !matches(user, ".*\$")
| fields _time, host, user, image_path, cmdline, parent_image,
         known_scanner, native_scan, port_range, service_version,
         suspicion_score, detection_type
| sort by _time desc
high severity high confidence

Detects T1046 network service discovery by parsing Sysmon Event ID 1 and Windows Security Event ID 4688 process creation records for known scanning tool binaries (nmap, masscan, zmap, rustscan, tcping) and native LOLBin scanning patterns in PowerShell and cmd.exe including TCP socket loops, Test-NetConnection, arp, and netstat. Assigns a suspicion score based on the number of risk indicators matched to support triage prioritisation.

Data Sources

Sumo Logic Installed Collector with Windows Event Log source (Security, Sysmon/Operational)Sumo Logic Cloud Syslog via Windows Event ForwardingSumo Logic Cloud-to-Cloud Microsoft Windows Event Log source

Required Tables

_sourceCategory=*Windows/Sysmon*_sourceCategory=*WinEventLog/Security*

False Positives & Tuning

  • Security tooling such as Tenable Nessus, Rapid7 InsightVM, or Qualys agents may spawn nmap or custom port scanners as part of authenticated credentialed network scan jobs
  • DevOps pipelines using PowerShell Test-NetConnection or custom TCP health-check scripts to verify dependent service availability across microservice environments before deployment gates
  • IT helpdesk staff troubleshooting network connectivity issues using built-in Windows tools such as netstat, arp, and route print from interactive desktop sessions

Other platforms for T1046

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 nmap SYN Scan Against Local Subnet

    Expected signal: Sysmon Event ID 1: Process Create with Image ending in nmap.exe, CommandLine containing '-sV -p' and '127.0.0.1'. Sysmon Event ID 3: Multiple network connection events from nmap.exe to 127.0.0.1 on specified ports. Sysmon Event ID 11: File created at %TEMP%\df00tech-nmap-test.txt. Security Event ID 4688 (if process command-line auditing enabled) showing nmap.exe process creation.

  2. Test 2 PowerShell TCP Port Scan via .NET Socket Loop

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Net.Sockets.TcpClient' and 'Connect'. Sysmon Event ID 3: Multiple network connection events from powershell.exe to 127.0.0.1 on each tested port. PowerShell ScriptBlock Log Event ID 4104 capturing the full socket enumeration script.

  3. Test 3 PowerShell Host Sweep with Test-NetConnection

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing '1..5', 'Test-NetConnection', and '-Port 80'. Sysmon Event ID 3: Multiple network connection attempts from powershell.exe to 127.0.0.1 through 127.0.0.5 on port 80. PowerShell ScriptBlock Log Event ID 4104 showing the full ForEach-Object loop.

  4. Test 4 NBTScan NetBIOS Network Discovery

    Expected signal: Sysmon Event ID 1: Process Create with Image ending in nbtscan.exe and CommandLine containing a target IP range. Sysmon Event ID 3: UDP connection attempts from nbtscan.exe to target IP on port 137 (NetBIOS Name Service). Security Event ID 4688 with nbtscan.exe process creation if command-line auditing is enabled.

  5. Test 5 Netstat Service Enumeration via CMD

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'netstat -ano' and 'findstr LISTENING'. Sysmon Event ID 11: File created at %TEMP%\df00tech-netstat.txt containing listening service output. Security Event ID 4688 for cmd.exe process if command-line auditing is enabled.

Last updated: 2026-04-17 Research depth: deep
References (9)

Response Playbook

Triage

  1. Identify the process and full command line — which scanning tool was used and what was the target scope (single host, subnet, full range)? Broad subnet scans (e.g., 10.0.0.0/8, 192.168.0.0/16) are more concerning than targeted single-host checks.
  2. Determine the user context — is this a dedicated scan host, a security engineer's workstation, or a standard endpoint where scanning tools are unexpected? Cross-reference with the asset inventory and user role.
  3. Check for a change ticket or authorized scan window — contact the network team or security operations to confirm whether a scan was scheduled. Verify against pentest engagement authorizations if applicable.
  4. Review the initiating process — what launched the scan? Office applications, browser processes, or script interpreters (wscript.exe, mshta.exe) spawning scanners is highly suspicious. Scheduled tasks or remote execution (PsExec, WMI) deserve elevated scrutiny.
  5. Examine scan targets — did the tool target internal subnets only, or include external IPs? Scanning of OT/ICS network segments, domain controllers, or privileged management subnets warrants immediate escalation.
  6. Check for temporal correlation — did this scanning activity follow other suspicious events such as a new process injection, credential access alert, or lateral movement indicator on the same host? Scanning that follows compromise is a strong post-exploitation indicator.
  7. Look for follow-on activity — did any lateral movement, exploitation attempts, or new connections to scanned hosts occur within 30 minutes of the scan completing?

Containment

  1. If scanning originated from an unexpected host with no authorized change ticket: isolate the endpoint from the network immediately using EDR network isolation or VLAN quarantine to prevent lateral movement to discovered services.
  2. If a compromised user account is suspected: disable the account in Active Directory, revoke Kerberos tickets (klist purge on affected host, reset password), and invalidate any OAuth/SSO sessions.
  3. If the scanner was dropped onto the system by malware: preserve the binary for forensic analysis before remediation, hash it, and submit to threat intelligence platforms. Block the hash via EDR and update AV signatures.
  4. Block outbound connections from the affected host to internal subnets not required for its business function using host-based firewall rules or network ACLs — this limits the usefulness of any discovered services.
  5. Notify the network team to review IDS/IPS alerts for the source IP — if the scanner generated scan traffic, network monitoring should have corresponding alerts that can help determine the full scope of discovered hosts.
  6. If scan results were written to disk (common with nmap XML/grepable output): recover and analyze the output files to understand exactly which services were mapped — this defines the attacker's target list.

Evidence Collection

  1. Process creation logs — Sysmon Event ID 1 or Security Event ID 4688 for the scanner process, including full command line, parent process, user context, and timestamp
  2. Scanner output files — nmap writes .xml, .gnmap, .nmap output files; masscan writes .json/.xml; NetScan writes .xml. Search for these on disk: C:\Users\*\AppData\Roaming\*, C:\Temp\*, C:\ProgramData\*
  3. Network connection logs — Sysmon Event ID 3 (Network Connection) for the scanner process showing destination IPs and ports; correlate with firewall/NAC logs to understand what was reachable
  4. File system artifacts — Prefetch file for the scanner binary (C:\Windows\Prefetch\NMAP*.pf, MASSCAN*.pf, NETSCAN*.pf) showing first and last execution timestamps and loaded modules
  5. DNS query logs — Sysmon Event ID 22 (DNS Query) for any reverse-lookup or hostname-resolution activity associated with the scan
  6. PowerShell ScriptBlock Logging (Event ID 4104) — if a PowerShell-based scanner was used, this captures the full script content including target ranges and port lists
  7. Scheduled task artifacts — HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks for persistence via scheduled scan tasks
  8. User's shell history — PowerShell ConsoleHost_history.txt, cmd doskey history, bash .bash_history — to determine if this was interactive or scripted activity

Escalation Criteria

  • !Scan originated from a non-scan host (workstation, server) with no authorized change ticket — indicates potential post-compromise reconnaissance
  • !Scanner binary was dropped and executed from a temp directory, user profile, or AppData path — strongly suggests attacker-delivered tooling rather than legitimate administrative use
  • !Scan targets included domain controllers, Active Directory infrastructure, privileged management hosts, or OT/ICS network segments
  • !Network service discovery immediately precedes lateral movement alerts or authentication attempts against discovered hosts
  • !Multiple hosts on the same subnet exhibit scanning behavior within a short time window — suggests automated propagation or a worm-like component
  • !The scanning process was spawned by a suspicious parent (Office application, browser, script engine) — indicates the scan is part of a post-exploitation chain following initial access
  • !Scan output files contain evidence of discovered vulnerable services (e.g., SMB on port 445 across multiple hosts, RDP on 3389) combined with subsequent exploitation attempts

Investigation Guide

Related Techniques

T1595.001 — Scanning IP Blocks (pre-compromise external reconnaissance)T1595.002 — Vulnerability Scanning (often follows service discovery)T1018 — Remote System Discovery (identifies hosts before service scanning)T1049 — System Network Connections Discovery (maps existing connections)T1016 — System Network Configuration Discovery (network topology enumeration)T1021.001 — Remote Desktop Protocol (lateral movement using discovered RDP services)T1021.002 — SMB/Windows Admin Shares (exploitation of discovered SMB services)T1021.006 — Windows Remote Management (exploitation of discovered WinRM services)T1110.003 — Password Spraying (often follows service discovery to identify auth targets)T1190 — Exploit Public-Facing Application (exploiting specific services found by scanning)

Forensic Artifacts

  • >File System: Scanner output files — nmap XML/grepable (*.xml, *.gnmap, *.nmap), masscan JSON (*.json), NetScan XML reports in user temp or working directory
  • >File System: C:\Windows\Prefetch\NMAP*.pf, MASSCAN*.pf, TCPING*.pf — execution timestamps, run count (up to 8 runs tracked), loaded DLLs
  • >Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — recent Run dialog executions including scanner launches
  • >Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths — evidence of scanner binary registration
  • >Event Log: Sysmon Event ID 3 (Network Connection) entries for the scanner process with destination IP ranges and ports
  • >Event Log: Sysmon Event ID 11 (File Create) for scanner output files written to disk
  • >Event Log: Sysmon Event ID 22 (DNS Query) for hostname resolution associated with scan targets
  • >Network: PCAP/NetFlow data showing TCP SYN sweep or UDP probe patterns to multiple ports/hosts in short timeframe — classic scan signature
  • >Shell History: PowerShell ConsoleHost_history.txt ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt) for interactive scan commands
  • >MFT (Master File Table): $MFT or $LogFile entries for recently created/deleted scanner binaries and output files — useful when files were deleted post-scan

Tuning Guidance

The primary tuning challenge for T1046 detection is distinguishing authorized network management and security scanning from post-compromise reconnaissance. Begin by building an allowlist of authorized scan hosts — typically dedicated vulnerability management servers (Nessus, Qualys, Rapid7) and jump hosts used by network engineers. Exclude these hosts by DeviceName from the KnownScanners branch. For the NativeScan branch, baseline legitimate Test-NetConnection usage in your environment — monitoring scripts checking service health are common. Build an exclusion list based on the initiating process (e.g., scheduled task names for known monitoring scripts) rather than by command-line pattern alone, as patterns can be spoofed. For the network-behavior hunting queries, tune the thresholds (UniqueHosts > 20, UniquePorts > 10) based on your environment's baseline — highly connected service accounts on dense networks may naturally exceed these. Consider narrowing the scan-type detection for non-scan hosts to a much lower threshold (e.g., UniqueHosts > 5 in 5 minutes from a standard workstation). Tag scan host exceptions in your CMDB and create a lookup table for automated suppression. Importantly, never suppress the detection entirely for unexpected process parents — a browser or Office document spawning nmap.exe has no legitimate explanation regardless of the user.

Hunting Queries

Hunt for host sweep or port scan patterns by analyzing network connection volume per process in 5-minute windows. Flags processes attempting connections to more than 20 unique hosts (host sweep) or more than 10 unique ports (port scan). Categorizes scan type to help distinguish broad reconnaissance (FullScan) from targeted service probing (PortScan) or ICMP-style ping sweeps (HostSweep). Catches scanners that don't match known binary names.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionAttempted" or ActionType == "ConnectionFailed"
| summarize
    PortsAttempted = dcount(RemotePort),
    UniqueHosts = dcount(RemoteIP),
    TotalAttempts = count(),
    PortList = make_set(RemotePort, 50),
    HostList = make_set(RemoteIP, 10)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 5m)
| where PortsAttempted > 10 or UniqueHosts > 20
| extend ScanType = case(
    UniqueHosts > 20 and PortsAttempted <= 5, "HostSweep",
    PortsAttempted > 10 and UniqueHosts <= 3, "PortScan",
    UniqueHosts > 10 and PortsAttempted > 5, "FullScan",
    1=1, "Unknown"
  )
| sort by TotalAttempts desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| bin _time span=5m
| stats
    dc(DestinationIp) as UniqueHosts,
    dc(DestinationPort) as UniquePorts,
    count as TotalConns,
    values(DestinationPort) as PortList
  by _time, host, Image, User
| where UniqueHosts > 20 OR UniquePorts > 10
| eval ScanType=case(
    UniqueHosts > 20 AND UniquePorts <= 5, "HostSweep",
    UniquePorts > 10 AND UniqueHosts <= 3, "PortScan",
    UniqueHosts > 10 AND UniquePorts > 5, "FullScan",
    1=1, "Unknown"
  )
| sort - TotalConns

Hunt for lateral spread of scanning tools — identifies accounts running known scanner binaries across multiple endpoints or with unusually high execution frequency. A single user running nmap on one authorized scan host is expected; the same user running it across 5+ endpoints is a strong compromise indicator. Useful for detecting worm-assisted tooling deployment or a threat actor moving laterally with their scanner.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("nmap.exe", "masscan.exe", "zmap.exe", "tcping.exe",
                       "netscan.exe", "superscan.exe", "nbtscan.exe",
                       "angryipscan.exe", "netdiscover", "rustscan")
| summarize
    ExecutionCount = count(),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp),
    Devices = make_set(DeviceName),
    DeviceCount = dcount(DeviceName),
    CommandLines = make_set(ProcessCommandLine, 20)
  by AccountName, FileName
| where DeviceCount > 1 or ExecutionCount > 5
| sort by DeviceCount desc, ExecutionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\nmap.exe" OR Image="*\\masscan.exe" OR Image="*\\zmap.exe" OR Image="*\\tcping.exe"
   OR Image="*\\netscan.exe" OR Image="*\\superscan.exe" OR Image="*\\nbtscan.exe")
| stats
    count as ExecCount,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen,
    dc(host) as DeviceCount,
    values(host) as Devices,
    values(CommandLine) as CommandLines
  by User, Image
| where DeviceCount > 1 OR ExecCount > 5
| sort - DeviceCount ExecCount

Hunt specifically for PowerShell-based port scanning without any known external binary — the 'living off the land' variant favored by nation-state actors like Volt Typhoon. Identifies for-loop IP/port enumeration (1..254), .NET TcpClient socket probing, and Test-NetConnection mass-checking patterns. These techniques generate no dropped binary artifacts and are invisible to file-based AV.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"1\.\.(254|255|65535)"
    or ProcessCommandLine has "System.Net.Sockets.TcpClient"
    or ProcessCommandLine has "Net.Sockets.Socket"
    or (ProcessCommandLine has "Test-NetConnection" and ProcessCommandLine matches regex @"\b(1[0-9]{1,2}|2[0-5]{2}|[1-9][0-9]?)\b.*\b(1[0-9]{1,2}|2[0-5]{2}|[1-9][0-9]?)\b")
| extend ScanMethod = case(
    ProcessCommandLine matches regex @"1\.\.(254|255|65535)", "ForLoopScan",
    ProcessCommandLine has "TcpClient", "DotNetTcpClientScan",
    ProcessCommandLine has "Net.Sockets.Socket", "RawSocketScan",
    1=1, "TestNetConnectionScan"
  )
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
         InitiatingProcessFileName, ScanMethod
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*1..254*" OR CommandLine="*1..255*" OR CommandLine="*1..65535*"
   OR CommandLine="*TcpClient*" OR CommandLine="*Net.Sockets*"
   OR CommandLine="*Test-NetConnection*")
| eval ScanMethod=case(
    match(CommandLine, "1\.\.(254|255|65535)"), "ForLoopScan",
    match(CommandLine, "TcpClient"), "DotNetTcpScan",
    match(CommandLine, "Net\.Sockets"), "RawSocketScan",
    match(CommandLine, "Test-NetConnection"), "TestNetConnectionScan",
    1=1, "Other"
  )
| table _time, host, User, CommandLine, ParentImage, ScanMethod
| sort - _time

Atomic Red Team Tests

Test 1 nmap SYN Scan Against Local Subnet
windows

Executes nmap with a TCP SYN scan against the local loopback range, simulating the most common network service discovery technique used by threat actors including APT39 and FIN13. The -sV flag enables service version detection, which is characteristic of adversary pre-exploitation reconnaissance. Safe to run as it targets localhost only.

Command

powershell 
nmap.exe -sV -p 22,80,443,445,3389,8080 127.0.0.1 -oN %TEMP%\df00tech-nmap-test.txt

Cleanup

powershell 
del /f %TEMP%\df00tech-nmap-test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image ending in nmap.exe, CommandLine containing '-sV -p' and '127.0.0.1'. Sysmon Event ID 3: Multiple network connection events from nmap.exe to 127.0.0.1 on specified ports. Sysmon Event ID 11: File created at %TEMP%\df00tech-nmap-test.txt. Security Event ID 4688 (if process command-line auditing enabled) showing nmap.exe process creation.

Expected Detection

KQL: KnownScanners branch triggers on FileName matching nmap.exe with PortRangeFlag=true and ServiceVersionProbe=true. SPL: KnownScanner=1, ServiceVersionProbe=1, SuspicionScore >= 2. Network hunting query identifies rapid multi-port connections from nmap.exe in the 5-minute window.

Test 2 PowerShell TCP Port Scan via .NET Socket Loop
windows

Performs a PowerShell-based port scan using .NET TcpClient socket connections in a for-loop against localhost. This living-off-the-land technique requires no external binaries and is used by threat actors including Volt Typhoon and in post-exploitation frameworks like Empire. Generates no file artifacts that antivirus can detect.

Command

powershell 
powershell.exe -NoProfile -Command "$ports = @(22,80,443,445,3389,8080,5985); foreach ($port in $ports) { try { $tcp = New-Object Net.Sockets.TcpClient; $tcp.Connect('127.0.0.1', $port); Write-Output "Port $port open"; $tcp.Close() } catch { Write-Output "Port $port closed" } }"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Net.Sockets.TcpClient' and 'Connect'. Sysmon Event ID 3: Multiple network connection events from powershell.exe to 127.0.0.1 on each tested port. PowerShell ScriptBlock Log Event ID 4104 capturing the full socket enumeration script.

Expected Detection

KQL: NativeScanning branch triggers on PowerShell with 'Net.Sockets' pattern. SPL: NativeScan=1, SuspicionScore >= 1. PowerShell socket hunting query matches TcpClient pattern with ScanMethod=DotNetTcpClientScan.

Test 3 PowerShell Host Sweep with Test-NetConnection
windows

Uses PowerShell Test-NetConnection (TNC) in a loop to sweep a range of loopback addresses checking for open HTTP port 80. This pattern — using a loop with TNC or ping — is a common living-off-the-land host discovery technique that requires only built-in Windows cmdlets. Used in post-exploitation scenarios to identify active hosts before targeted lateral movement.

Command

powershell 
powershell.exe -NoProfile -Command "1..5 | ForEach-Object { Test-NetConnection -ComputerName "127.0.0.$_" -Port 80 -InformationLevel Quiet -WarningAction SilentlyContinue }"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing '1..5', 'Test-NetConnection', and '-Port 80'. Sysmon Event ID 3: Multiple network connection attempts from powershell.exe to 127.0.0.1 through 127.0.0.5 on port 80. PowerShell ScriptBlock Log Event ID 4104 showing the full ForEach-Object loop.

Expected Detection

KQL: NativeScanning branch triggers on 'Test-NetConnection' and '1..' loop pattern. SPL: NativeScan=1 on Test-NetConnection match. PowerShell socket hunting query matches TestNetConnectionScan method. Network hunting query may flag rapid connection attempts from powershell.exe.

Test 4 NBTScan NetBIOS Network Discovery
windows

Executes nbtscan against localhost to discover NetBIOS-enabled systems — a technique used by Mustang Panda and other threat actors for rapid Windows host discovery on local subnets. NetBIOS scanning is lighter-weight than full TCP scanning and reveals Windows hostname and domain information without requiring elevated privileges.

Command

powershell 
nbtscan.exe 127.0.0.1/32

Expected Telemetry

Sysmon Event ID 1: Process Create with Image ending in nbtscan.exe and CommandLine containing a target IP range. Sysmon Event ID 3: UDP connection attempts from nbtscan.exe to target IP on port 137 (NetBIOS Name Service). Security Event ID 4688 with nbtscan.exe process creation if command-line auditing is enabled.

Expected Detection

KQL: KnownScanners branch triggers on FileName matching nbtscan.exe. SPL: KnownScanner=1, SuspicionScore >= 1. Scanner prevalence hunting query identifies nbtscan.exe execution with execution frequency and device spread analysis.

Test 5 Netstat Service Enumeration via CMD
windows

Uses the built-in netstat command to enumerate all listening services and established connections — a reconnaissance technique used by virtually every post-exploitation framework and threat actor when mapping available services before lateral movement. While netstat alone is low-signal, when combined with other discovery techniques or unusual parent processes it is a strong indicator.

Command

powershell 
cmd.exe /c netstat -ano | findstr LISTENING > %TEMP%\df00tech-netstat.txt && type %TEMP%\df00tech-netstat.txt

Cleanup

powershell 
del /f %TEMP%\df00tech-netstat.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'netstat -ano' and 'findstr LISTENING'. Sysmon Event ID 11: File created at %TEMP%\df00tech-netstat.txt containing listening service output. Security Event ID 4688 for cmd.exe process if command-line auditing is enabled.

Expected Detection

KQL: NativeScanning branch triggers on 'netstat' pattern in cmd.exe command line. SPL: NativeScan=1 on netstat pattern match, SuspicionScore >= 1. Context is elevated if parent process is unusual (Office, browser, script engine).

Related Detections

Tactic Hub

TA0007 Discovery

Related Techniques

T1595.001 Scanning IP Blocks T1595.002 Vulnerability Scanning T1018 Remote System Discovery T1049 System Network Connections Discovery T1016 System Network Configuration Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.006 Windows Remote Management T1110.003 Password Spraying T1190 Exploit Public-Facing Application

Same Tactic: Discovery

Popular Detections